Unauthorized Access

[karthikeyanB]

Hi All,

we had an unauthorised access to our firewall, after the access all the logs in the firewall have been deleted and configurations have been changed and committed. 

we need to which credential are used to login the firewall.

Now we found the ip address as well as what changes are they made.

there is any other chance for restoring  the deleted file.

Regards

Karthikeyan 

[BPry]

@karthikeyanB,

If you don't have the logs anymore and you aren't sending them off of the firewall then you essentially don't have anything to view what credentials were used to make those changes anymore. I would recommend you simply have anyone with credentials change them. Same thing goes with restoring the configuration or log files, if you weren't already sending them elsewhere you have nothing to restore from. 

Just a few things I would really recommend you do to increase security:

• Utilizes permitted-ips on the management interfaces to restrict management access to a few machines. 
• Assuming that the GUI was open to the internet, absolutely stop doing this. If required restrict it to one external IP address under your control. 
• Configure log forwarding so the logs aren't only on the firewall.
• Configure log settings so you get alerted for any configuration change made to the device; and if that's to chatty for you at least configure an alert for when a commit is performed.