Monitoring Firewall Service
Firewalls are a networks first line of defense against malicious computer users (commonly called “hackers”). To maintain the security of your computers and users, you need to monitor firewall activity and deter potential threats. This sections explains how to log and monitor your firewall.
Viewing the Firewall Status Overview
The Status Overview shows a simple summary of the firewall service. It shows whether or not the service is running and which filters rules are active.
To see the overview:
1In Server Admin, choose Firewall from the Computers & Services list.
2Click the Overview button.
Setting Up Logs for Firewall Service
You can log only the packets that are denied by the filters you set, only the packets that are allowed, or both. Both logging options can generate a lot of log entries, which can fill up disk space and degrade the performance of the server. You should use “Log all allowed packets” only for limited periods of time.
You can choose to log allowed packets, denied packets, and a designated number of packets.
To set up logs:
1In Server Admin, choose Firewall from the Computers & Services list.
2Click Settings.
3Select the Logging tab.
4Select the logging options you want.
5Click Save to start logging.
Viewing the Firewall Log
Each filter you create in Server Admin corresponds to one or more rules in the underlying firewall software. Log entries show you the rule applied, the IP address of the client and server, and other information.
To view the log for firewall service:
1In Server Admin, choose Firewall from the Computers & Services list.
2Click Settings.
3Select the Log tab.
Here are some examples of firewall log entries and how to read them.
Chapter 3 IP Firewall Service
55
