I have a router just outside my PAN 500, ver 4.0.5. I need to get syslog information in from it for my PCI requirements. Here is my setup:
The following objects are defined:
INT-NPM Syslog server, IP address 126.96.36.199
TWC-RTR Router, 188.8.131.52
TWC-NPM NAT address for INT-NPM, 184.108.40.206
TWC-NAT Internal NAT for TWC internet comm; 220.127.116.11
Services: Syslog: 514/TCP and Syslog-UDP: 514/UDP
The following policies are defined:
Internal to External, no dest int, Source INT-NPM, any dest, any service, IP: static-ip, Translated Address: TWC-NPM, BI-dir YES.
External to ANY, User ANY, HIP Profile ANY, Dest zone Internal, address WTC-NPM, Any application, both Syslog services, action ALLOW
What I get in the traffic log when I force a change that results in a syslog-able event, is this:
Time, drop, frm External, to Internal, source 18.104.22.168, destination 22.214.171.124, to port 514, action deny.
Any idea what I am doing wrong? I had it setup the same as my exchange server (different services) but it always seemed ot deny the traffic (falling down to my catch-all rule). I've tried teh destination as the external NAT address and teh internal address in the security rule: neither seems to work.
Message was edited by: email@example.com
Hi...TWC-NPM was given IP 126.96.36.199, and the traffic log reported destination 188.8.131.52. Could it be the router is pointing to the wrong IP for the syslog server?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!
The Live Community thanks you for your participation!