I have a router just outside my PAN 500, ver 4.0.5. I need to get syslog information in from it for my PCI requirements. Here is my setup:
The following objects are defined:
INT-NPM Syslog server, IP address 22.214.171.124
TWC-RTR Router, 126.96.36.199
TWC-NPM NAT address for INT-NPM, 188.8.131.52
TWC-NAT Internal NAT for TWC internet comm; 184.108.40.206
Services: Syslog: 514/TCP and Syslog-UDP: 514/UDP
The following policies are defined:
Internal to External, no dest int, Source INT-NPM, any dest, any service, IP: static-ip, Translated Address: TWC-NPM, BI-dir YES.
External to ANY, User ANY, HIP Profile ANY, Dest zone Internal, address WTC-NPM, Any application, both Syslog services, action ALLOW
What I get in the traffic log when I force a change that results in a syslog-able event, is this:
Time, drop, frm External, to Internal, source 220.127.116.11, destination 18.104.22.168, to port 514, action deny.
Any idea what I am doing wrong? I had it setup the same as my exchange server (different services) but it always seemed ot deny the traffic (falling down to my catch-all rule). I've tried teh destination as the external NAT address and teh internal address in the security rule: neither seems to work.
Message was edited by: email@example.com
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!