RSA Event Source Configuration Guide. McAfee Firewall Enterprise

Transcription

1 Configuration Guide McAfee Firewall Enterprise Last Modified: Wednesday, October 24, 2012 Event Source (Device) Product Information Vendor McAfee Event Source (Device) Firewall Enterprise (formerly Secure Computing Sidewinder G2 Security Appliance) Supported Versions x, x, x, 8.0, and 8.2 RSA Product Information Supported Version RSA envision 4.0 and 4.1 NetWitness for Logs 9.7 Event Source (Device) Type sidewinder, 74 Collection Method Syslog Event Source (Device) Class.Subclass Security.Firewall Content 2.0 Table Firewall This document contains the following information for the McAfee Firewall Enterprise event source: Configuration Instructions Release Notes for Content 2.0 Release Notes for Standard Content McAfee Firewall Enterprise Configuration Instructions Depending on your version of McAfee Firewall Enterprise, do one of the following tasks: Configure Sidewinder G2 Security Appliance 7.0 and earlier Configure McAfee Firewall Enterprise 8.0 and 8.2 Important: For the StartTime and EndTime columns to display properly for McAfee Firewall Enterprise 8.2, you must install RSA envision 4.0 SP4 Patch 7 or RSA envision 4.1 Patch 5 or later. These patches are available at RSA SecurCare Online. Copyright 2012 EMC Corporation. All Rights Reserved.

2 Configure Sidewinder G2 Security Appliance 7.0 and earlier To configure Sidewinder: 1. Log on to the Sidewinder appliance. 2. To configure Sidewinder to send syslog messages, do the following: a. Use a text editor to open the file /etc/sidewinder/auditd.conf. b. Search for the filebegin_rules section and locate the following lines: log(logfile filters[] type) syslog(facility filters[] format) ipaddr_resolution(src_addr dst_addr) time_format(zone) end_rules Note: If the filebegin_rules section does not display in your search, type the lines listed in this step into the file. c. After the lines listed in step b, type the following: syslog(local0 filters["null"] sef) d. Save and close the file. 3. To configure Sidewinder to send syslog messages to the RSA envision appliance, follow these steps: a. Use a text editor to open the file /etc/syslog.conf. b. Type the following line: where <Platform> is your envision appliance. Note: If you wish to send a syslog to two different IP addresses, enter two "local0" entries: where <Platform> is your envision appliance. c. Save and close the file. 4. To restart the auditd and syslogd services, do the following: a. Enter the following command to go to the administrator domain: srole 2 Configure Sidewinder G2 Security Appliance 7.0 and earlier

3 b. Depending on your version of Sidewinder, type the following commands to restart the services: For Sidewinder versions and later, type: cf daemond restart agent=syslog cf daemond restart agent=auditd For Sidewinder versions prior to 7.0.0, type: kill -HUP syslogpid cf server restart auditd Configure Sidewinder G2 Security Appliance 7.0 and earlier 3

4 Configure McAfee Firewall Enterprise 8.0 and 8.2 To configure McAfee Firewall Enterprise: Important: For the StartTime and EndTime columns to display properly for McAfee Firewall Enterprise 8.2, you must install RSA envision 4.0 SP4 Patch 7 or RSA envision 4.1 Patch 5 or later. These patches are available at RSA SecurCare Online. 1. Log on to the McAfee Firewall Enterprise console and connect to the firewall that you want to configure. 2. In the file tree, click Firewall Name > Monitor > Audit Management. 3. On the Firewall Reporter/Syslog tab, in the Export audit to syslog servers section, follow these steps: a. Click the + button. b. In the new row, enter the following. Column IP Address Remote Facility Description Action Enter the IP address of your envision appliance. Leave the default value local0. (Optional) Enter a description. 4. Click the save button. 5. To restart the NIC Service Manager Service on your RSA envision appliance, follow these steps: a. Log on to your RSA envision appliance with administrator credentials. b. Click Start > Administrative Tools > Services. c. Click NIC Service Manager. d. Click Restart. 4 Configure McAfee Firewall Enterprise 8.0 and 8.2

5 Content 2.0 Release Notes McAfee Firewall Enterprise Release Notes ( ) McAfee Firewall Enterprise Release Notes ( ) McAfee Firewall Enterprise Release Notes ( ) McAfee Firewall Enterprise Release Notes ( ) What's New in This Release RSA added support for McAfee Firewall Enterprise 8.2. McAfee Firewall Enterprise Release Notes ( ) McAfee Firewall Enterprise Release Notes ( ) McAfee Firewall Enterprise Release Notes ( ) Content 2.0 Release Notes 5

6 6 Content 2.0 Release Notes

7 Standard Content Release Notes McAfee Firewall Enterprise Release Notes ( ) What's New in This Release RSA added support for McAfee Firewall Enterprise 8.2. Standard Content Release Notes 7