Web-Based Configuration Manual System Report. Table of Contents

Transcription

1 Table of Contents Table of Contents Information Center Overview Configuring the Log Host Log Host Configuration Tasks Log Host Configuration Details Configuring the Log Buffer Viewing the Log Information Firewall Log Statistics Introduction to Firewall Log Statistics Log Statistics Configuration Tasks Chapter 2 Flow Statistics Configuring Flow Statistics Flow Statistics Configuration Tasks Flow Statistics Configuration Details Viewing Flow Statistics i

2 1.1 Information Center Overview As an indispensable part of the main software of the firewall, the information center acts as an information hub of the firewall. It manages most information outputs, sorts the information, and hence can filter the information efficiently. Coupled with the debug program, the information center can provide powerful support for the network administrators and developers to monitor network operation conditions and diagnose network faults. The information center of the system features the following: Three types of information available, namely, log information, trap information, and debug information. Eight levels by severity to allow hierarchical filtering. Ten channels, with the first six channels (Channels 0 through 5) having their default channel names and associated with six output directions by default. The channel names and the associations between the channels and output directions can be changed through commands. Six information output directions, including console, telnet terminal and console terminal (monitor), logbuffer, loghost, trapbuffer and SNMP. A variety of protocol modules, board drivers, and configuration modules. The information can be classified and filtered based on the source modules. Each information header consists of fixed parts, which are time stamp, information source module, information level, slot number of the information source, and information summary. To sum up, the major task of the information center is to output the three types of information of the modules to the ten channels based on the eight severity levels and the user s settings, and then redirect the ten information channels to the six output directions. 1.2 Configuring the Log Host Log Host Configuration Tasks Select System View > InfoCenter > Loghost from the navigation tree to enter the log host configuration page, as shown in Figure

3 Figure 1-1 Log host configuration page Complete these tasks to configure a log host: Task Configuring a log host Configuring the log information Description Select the LogHost tab to create a log host through Wizard, or configure an existing log host. Select the LogInfo tab to configure the output information to the log hosts Log Host Configuration Details I. Configuring a log host Select the LogHost tab to enter the log host configuration page, as shown in Figure 1-2. Click Create to create a log host through Wizard, or click Configure to configure an existing log host. Figure 1-2 Log host configuration page Select the InfoCenter Enable check box to enable the information center function and make the information center configuration take effect. 1-2

4 Table 1-1 Log host configuration items in the Wizard page Wizard page Item Description Set Logging Host IP Address Set Language Environment of Logging Host Logging Host IP Address Logging Host Facility Language Environment Specify the IP address of the log host to which the log information will be sent. Select a log host tool. Select a language for the log information. II. Configuring the log information Select the LogInfo tab to enter the log information configuration page, as shown in Figure 1-3. Figure 1-3 Log information configuration page 1-3

5 Table 1-2 Log information configuration items No. Item Description 1 Log information level Select a log information level. 2 3 Source address of packets sent to Loghost Time stamp type of log information Select a source IP address in packets to be sent to the log host. Configure different IP addresses for different devices so that you can judge the source of the log information, to facilitate searching log information. Select a time stamp format of the log information sent to the log host. Date: Specifies the time stamp format to be date with year. No-year-date: Specifies the time stamp format to be date without year. None: Specifies no-information time stamp. 1.3 Configuring the Log Buffer Select System View > InfoCenter > LogBuffer from the navigation tree to enter the log buffer configuration page, as shown in Figure 1-4. Click Clear All to clear the log buffer. Figure 1-4 Log buffer configuration page 1-4

6 Table 1-3 Log buffer configuration items No. Item Description 1 Size of log buffer Specify the size of the log buffer. 2 Time stamp of log Select the format of the time stamp of the log information output to the terminal and log buffer. Boot: Specifies absolute information time stamp, in the format of xxxxxx.yyyyyy, where xxxxxx is the higher-order 32 bits and yyyyyy the lower-order 32 bits of the number of milliseconds passed since the system boots. Date: Specifies the date type of information time stamp, in the format of mm/dd/yyyy-hh:mm:ss. None: Specifies no-information time stamp. 1.4 Viewing the Log Information Select System View > Log View from the navigation tree to enter the interface log information page. Select the Interface tab to view the interface information (such as up or down), or select the Security tab to view the system security log information, as shown in Figure 1-5. Figure 1-5 Log information page 1.5 Firewall Log Statistics Introduction to Firewall Log Statistics I. Log categories The H3C SecPath series firewalls log all kinds of attacks and events and provide logs and statistics information with standardized format and contents and consistent style. The H3C SecPath series firewalls support the following log categories: NAT/ASPF log Defense log 1-5

7 Statistics log Blacklist log Address binding log II. About log output on the firewall Figure 1-6 illustrates the log output modes. Binary log NAT/ASPF Defense Log information Logged information Syslog logs Log server Statistics Blacklist Address binding Log information Log information Log information Log information Information center Redirect Terminal Console Buffers Figure 1-6 Log output on the firewall On a SecPath firewall, the amount of information from the defense log, statistics log, blacklist log, and address binding log is small. Therefore, these four types of log information is output in syslog format as text files, and must be managed and redirected by the information center, for example, displayed on the terminal screen or sent to the log server for storage and analysis Log Statistics Configuration Tasks Select System View > Log Statistics from the navigation tree to enter the firewall log statistics page, as shown in Figure 1-7. Click Configure to configure the firewall log statistics utility. 1-6

8 Figure 1-7 Firewall log statistics Complete these tasks to configure firewall log statistics: Task Enable Log Function of Inter-Zones Set Scan-Time of Log Function Set Output Styles Reset Log-Buffers Description This feature is not supported for Web-based management currently. Click Configure to enter the log buffer scan time configuration page. You can set the intervals for scanning the defense log buffer and the statistics log buffer. This feature is not supported for Web-based management currently. Click Configure to enter the log buffer clearing page, in which you can clear the defense log buffer and statistics log buffer. 1-7

9 Chapter 2 Flow Statistics Chapter 2 Flow Statistics 2.1 Configuring Flow Statistics Flow Statistics Configuration Tasks Select System View > Flow Statistics > Configuration from the navigation tree to enter the flow statistics configuration page, as shown in Figure 2-1. Figure 2-1 Flow statistics configuration page Complete these tasks to configure flow statistics: Task Configuring system flow statistics Configuring security zone flow statistics Description Select the System tab to set the number of connections and the flow percentage. Select the Security Zone tab to configure flow statistics for a specific security zone Flow Statistics Configuration Details I. Configuring system flow statistics The system flow statistics function of your SecPath firewall allows you to set limits on the numbers of connections and the flow percentage for the output of alarm information. 2-1

10 Chapter 2 Flow Statistics Select the System tab to enter the system flow statistics configuration page, as shown in Figure 2-2. Figure 2-2 System flow statistics configuration page Click Enable to enable the system flow statistics function before the system flow statistics configuration can take effect. Table 2-1 System flow statistics configuration items No. Item Description 1 2 Upper limit/lower limit for TCP Upper limit/lower limit for UDP Set the upper and lower limits of the numbers of TCP connections. If the number of connections exceeds the upper limit, the system outputs an alarm; if the number of connections is less than the lower limit, the system has come back to the normal state. Set the upper and lower limits to the numbers of UDP connections. If the number of connections exceeds the upper limit, the system outputs an alarm; if the number of connections is less than the lower limit, the system has come back to the normal state. 3 TCP Percentage Specify the TCP traffic percentage. 4 UDP Percentage Specify the UDP traffic percentage. 5 ICMP Percentage Specify the ICMP traffic percentage. 2-2

11 Chapter 2 Flow Statistics No. Item Description 6 Alternate Percentage 7 Check Time Value Specify the variation range for packets of all protocols. If the actual traffic percentage of a protocol (TCP, UDP, ICMP, or any other protocol) exceeds the upper limit (the set traffic percentage plus the variation range) or is less than the lower limit (the traffic percentage minus the variation range), the system outputs an alarm. Specify the interval of checking traffic percentages. II. Configuring security zone flow statistics Your SecPath firewall allows you to configure the upper and lower limits of the number of TCP and UDP connections and the per-second rates of TCP and UDP connections initiated to and from a security zone. Select the Security Zone tab to enter the security zone based flow statistics configuration page. Select a security zone and then click Configure, as shown in Figure 2-3. Figure 2-3 Security zone based flow statistics configuration page Before the security zone flow statistics configuration can take effect, you need to select a zone direction from the drop-down list, and then click Enable to enable flow statistics function based on security zone and IP address in the inbound or outbound direction. Table 2-2 Security zone based flow statistics configuration items No. Item Description 1 IP/Zone Select to perform the configuration based on IP address or security zone. 2 Direction Select a direction, inzone or outzone. 2-3

12 Chapter 2 Flow Statistics No. Item Description 3 Connect Type Select a connection type, TCP or UDP. 4 Statistics Type 5 Upper Limit 6 Lower Limit Select a statistics type, connect-number or connect-speed. Specify the upper limit: For security zone based flow statistics, the upper limit of the number of connections defaults to and ranges from 1 to For IP address based flow statistics, the upper limit of the number of connections defaults to and ranges from 1 to For security zone based flow statistics, the upper limit of the traffic rate defaults to and ranges from 1 to For IP address based flow statistics, the upper limit of the traffic rate defaults to and ranges from 1 to Specify the lower limit: For security zone based flow statistics, the lower limit of the number of connections defaults to and ranges from 1 to For IP address based flow statistics, the lower limit of the number of connections defaults to and ranges from 1 to For security zone based flow statistics, the lower limit of the traffic rate defaults to 9000 and ranges from 1 to For IP address based flow statistics, the lower limit of the traffic rate defaults to 9000 and ranges from 1 to Viewing Flow Statistics Select System View > Flow Statistics > Query&Reset from the navigation tree to enter the flow statistics summary page, as shown in Figure 2-4. Select the System tab to view the system flow statistics; select the Security Zone tab to view the view the flow statistics of a security zone; select the IP tab and specify an IP address to view the flow statistics about the specified IP address. 2-4

13 Chapter 2 Flow Statistics Figure 2-4 Flow statistics summary page 2-5