I have a router just outside my PAN 500, ver 4.0.5. I need to get syslog information in from it for my PCI requirements. Here is my setup: The following objects are defined: INT-NPM Syslog server, IP address 172.15.10.8 TWC-RTR Router, 197.148.156.124 TWC-NPM NAT address for INT-NPM, 197.148.156.150 TWC-NAT Internal NAT for TWC internet comm; 197.148.156.253 Services: Syslog: 514/TCP and Syslog-UDP: 514/UDP The following policies are defined: NAT: Internal to External, no dest int, Source INT-NPM, any dest, any service, IP: static-ip, Translated Address: TWC-NPM, BI-dir YES. Security: External to ANY, User ANY, HIP Profile ANY, Dest zone Internal, address WTC-NPM, Any application, both Syslog services, action ALLOW What I get in the traffic log when I force a change that results in a syslog-able event, is this: Time, drop, frm External, to Internal, source 197.148.156.124, destination 197.148.156.150, to port 514, action deny. Any idea what I am doing wrong? I had it setup the same as my exchange server (different services) but it always seemed ot deny the traffic (falling down to my catch-all rule). I've tried teh destination as the external NAT address and teh internal address in the security rule: neither seems to work. Message was edited by: rhanna@lamadeleine.com
... View more