Getting Syslog in through PA 500

u7483 — Fri, 01 Jun 2012 18:01:26 GMT

I have a router just outside my PAN 500, ver 4.0.5. I need to get syslog information in from it for my PCI requirements. Here is my setup:

The following objects are defined:

INT-NPM Syslog server, IP address 172.15.10.8

TWC-RTR Router, 197.148.156.124

TWC-NPM NAT address for INT-NPM, 197.148.156.150

TWC-NAT Internal NAT for TWC internet comm; 197.148.156.253

Services: Syslog: 514/TCP and Syslog-UDP: 514/UDP

The following policies are defined:

NAT:

Internal to External, no dest int, Source INT-NPM, any dest, any service, IP: static-ip, Translated Address: TWC-NPM, BI-dir YES.

Security:

External to ANY, User ANY, HIP Profile ANY, Dest zone Internal, address WTC-NPM, Any application, both Syslog services, action ALLOW

What I get in the traffic log when I force a change that results in a syslog-able event, is this:

Time, drop, frm External, to Internal, source 197.148.156.124, destination 197.148.156.150, to port 514, action deny.

Any idea what I am doing wrong? I had it setup the same as my exchange server (different services) but it always seemed ot deny the traffic (falling down to my catch-all rule). I've tried teh destination as the external NAT address and teh internal address in the security rule: neither seems to work.

Message was edited by: rhanna@lamadeleine.com

Re: Getting Syslog in through PA 500

rmonvon — Sat, 02 Jun 2012 20:47:49 GMT

Hi...TWC-NPM was given IP 197.148.156.150, and the traffic log reported destination 198.148.156.150. Could it be the router is pointing to the wrong IP for the syslog server?

Re: Getting Syslog in through PA 500

u7483 — Fri, 08 Jun 2012 14:25:02 GMT

Unfortunatyely that was me mis-typing the IP address here, not in the PA. Sorry.

Re: Getting Syslog in through PA 500

rmonvon — Fri, 08 Jun 2012 14:35:48 GMT

Your NAT and security rules appear to be correct. I recommend you contact Support and open a case. Thanks.

topic Re: Getting Syslog in through PA 500 in General Topics

Getting Syslog in through PA 500

Re: Getting Syslog in through PA 500

Re: Getting Syslog in through PA 500

Re: Getting Syslog in through PA 500