WatchGuard Technologies Firebox X Setting Up Logging and Notification, Setting Up the Log Server

CHAPTER 4 Setting Up Logging and Notification

An event is any single activity that occurs at the Firebox®, such as denying a packet from passing through the Firebox. Logging is the recording of these events to a log host. A notification is a message sent to the administrator by the Firebox when an event occurs that indicates a security threat. Notification can be in the form of e-mail or a pop-up window.

For example, WatchGuard® recommends that you configure default packet handling to issue a notifica- tion when the Firebox finds a port space probe. When this occurs, the log host sends notification to the network security administrator about the rejected packets. The network security administrator can exam- ine the log files and make decisions about how to add more security to the organization’s network. Some possible changes are:

•Block the ports on which the probe was used

•Block the IP address that is sending the packets

•Tell the ISP through which the packets are being sent

Logging and notification are crucial to an effective network security policy. Together, they make it possi- ble to monitor your network security, identify attacks and attackers, and to address security threats and challenges.

You can install the Log Server on the computer you are using as a management station. Or, you can install the log server software on a different computer using the WatchGuard System Manager installation program and selecting to install only the Log Server component. To add other log servers, see the Config- uration Guide for your version of appliance software.

Note

If you install the Management Server, Log Server, or WebBlocker Server on a computer with a desktop firewall other than Windows Firewall, you must open the ports necessary for the servers to connect through the firewall. Windows Firewall users do not have to change their configuration. See “Installing WatchGuard Servers on computers with desktop firewalls” on page 8 for more information.

Setting Up the Log Server

The Log Server collects logs from each WatchGuard® Firebox®.

User Guide 31