User FAQ for H3C SecCenter Firewall Manager

Transcription

1 User FAQ for H3C SecCenter Firewall Manager Copyright 2012 Hangzhou H3C Technologies Co., Ltd. All rights reserved. No part of this manual may be reproduced or transmitted in any form or by any means without prior written consent of Hangzhou H3C Technologies Co., Ltd. The information in this document is subject to change without notice.

2 Contents FAQ on system management... 1 What H3C SecCenter Firewall Manager can do?... 1 What are software and hardware requirements of the Firewall Manager?... 1 Why does a time calibration option appear when I add a device?... 1 When the multi-card device option is used for adding devices?... 2 What is hierarchical management?... 2 Must the receiving port of syslog messages be port 30514?... 2 FAQ on firewall management... 2 What do operation logs and other logs mean?... 2 How can the Firewall Manager audit inter-domain policy logs?... 2 How can the Firewall Manager audit abnormal traffic logs?... 2 How can the Firewall Manager audit blacklist logs?... 3 How can the Firewall Manager audit NAT logs?... 3 Can the Firewall Manager audit userlog messages sent by devices in V1 or V3 format?... 3 Why can I query NAT logs only for a specific period of time, not all system-recorded logs?... 3 How does the Firewall Manager process received NAT logs?... 3 What devices can generate MPLS logs?... 4 How does the Firewall Manager process logs from devices not added on it?... 4 Are logs on the Firewall Manager are deleted periodically?... 4 How can I configure an inter-domain policy to apply to any IP address or service?... 4 FAQ on troubleshooting... 4 What are the possible reasons for failed installation of the Firewall Manager?... 4 I cannot access the Firewall Manager page. How to troubleshoot this problem?... 4 What are the possible reasons for failed addition of devices?... 5 Data cannot be displayed normally. How to troubleshoot this problem?... 5 i

3 User FAQ for H3C SecCenter Firewall Manager FAQ on system management What H3C SecCenter Firewall Manager can do? H3C SecCenter Firewall Manager (hereinafter referred to as Firewall Manager) is a powerful system for comprehensive analysis and centralized management of firewall devices. It is an important component of the H3C Security Management Center (SecCenter). As a powerful, efficient firewall management system, the Firewall Manager has the following features: Centralized management of firewall devices throughout the network. Visual, realtime monitoring of network traffic, which can help you detect network attacks in time. Comprehensive analysis and rich statistics reports, from which you can see the history security status and the security trends of the network. Detailed logs. You can audit logs to track security events. Centralized security policy deployment, which ensures consistency of network security policies and eases deployment. Friendly and easy-to-use interface. What are software and hardware requirements of the Firewall Manager? Hardware CPU Pentium or later, RAM 1.5 GB or above, and hard drive 80 GB or above. Operating System Windows 2003 Server (recommended) or Windows XP installed with the latest patch. Browser Internet Explorer 6.0 or later. To install the Firewall Manager, execute the install.exe file in the installation directory and click Next as prompted. After the installation, reboot the OS. Why does a time calibration option appear when I add a device? The time in NAT logs (including NetStream flow logs) adopts the number of seconds since January 1, 1970 Greenwich Time. However, during feature development, the time zone factor is taken into account for some devices, and not for others. It is difficult for the Firewall Manager to determine the time. Therefore, a time calibration option is added on the Firewall Manager, with Greenwich Time used by default. If the time zone factor is taken into account on the device, select Local time for Time Calibration on the Firewall Manager. In this case, the Firewall Manager automatically increases the number of hours for the time zone after receiving NAT logs from the device, for example, eight hours for Beijing time zone. In addition, the device and the Firewall Manager server can be configured with different time zones, so time calibration should be performed according to the actual situation. 1

4 When the multi-card device option is used for adding devices? This option is used only for H3C ACG8800-S3. What is hierarchical management? Hierarchical management implements centralized management and monitoring of multiple Firewall Manager systems. After you log in to a Firewall Manager system, you can directly log in to all its child Firewall Manager systems without providing their URLs and the corresponding usernames and passwords.. Must the receiving port of syslog messages be port 30514? No. By default, the Firewall Manager uses port to receive syslog messages. You can select System > System Config > Management Ports to change the port number, but you should make sure this setting is the same on the device and the Firewall Manager. You can also change the receiving port of other log messages, for example, port (default) for NAT log messages. FAQ on firewall management What do operation logs and other logs mean? The Firewall Manager divides system logs reported by devices into operation logs and other logs. Operation logs record CLI and Web operations. Other logs refer to system logs other than operation logs. How can the Firewall Manager audit inter-domain policy logs? The Firewall Manager can audit inter-domain policy logs if the following conditions are met: Inter-domain policy logs are generated on devices. Devices are configured to send syslog messages to the log host, whose IP address is set to that of the Firewall Manager and port number to the number of the receiving port of syslog messages configured on the Firewall Manager. How can the Firewall Manager audit abnormal traffic logs? The Firewall Manager can audit abnormal traffic logs if the following conditions are met: Logs for connection count limit and attack prevention are generated on devices. Devices are configured to send syslog messages to the log host, whose IP address is set to that of the Firewall Manager and port number to the number of the receiving port of syslog messages configured on the Firewall Manager. 2

5 How can the Firewall Manager audit blacklist logs? The Firewall Manager can audit blacklist logs if the following conditions are met: Blacklist logs are generated on devices. Devices are configured to send syslog messages to the log host, whose IP address is set to that of the Firewall Manager and port number to the number of the receiving port of syslog messages configured on the Firewall Manager. How can the Firewall Manager audit NAT logs? The Firewall Manager can audit NAT logs if the following conditions are met: Userlogs are generated on devices. (Userlogs are UDP packets with port as the source port sent by the device and are audited as NAT logs on the Firewall Manager.) Devices are configured to send userlog messages to the log host, whose IP address is set to that of the Firewall Manager and port number to the number of the receiving port of NAT logs configured on the Firewall Manager. You must clear the Output userlog to information center box on the device. Can the Firewall Manager audit userlog messages sent by devices in V1 or V3 format? Yes. The Firewall Manager supports both formats. Why can I query NAT logs only for a specific period of time, not all system-recorded logs? NAT logs are large in number, so the Firewall Manager does not support displaying all NAT logs and allows users to query NAT logs only for a specific period of time. How does the Firewall Manager process received NAT logs? The Firewall Manager processes received NAT logs in two steps: Records logs to the database Because NAT logs are massive, the Firewall Manager saves a database sheet on a hourly basis. The file name of the sheet ends with the log receiving time. For example, indicates logs received between 08:00 am and 09:00 am on December 10, Queries by flow start time or end time After you select a search period, the Firewall Manager finds the database sheets for that period and then queries logs whose flow start time or end time also falls within the period. Therefore, the Firewall Manager returns the NAT logs with both receiving time and flow start time or end time falling within the search period. 3

6 What devices can generate MPLS logs? Switches can generate MPLS logs, and firewalls do not. How does the Firewall Manager process logs from devices not added on it? The Firewall Manager directly discards them. Are logs on the Firewall Manager are deleted periodically? Yes. Select System > System Config > Log Retention Time to set the retention time for logs, and expired logs are deleted. How can I configure an inter-domain policy to apply to any IP address or service? To apply a policy to any IP address or service, leave the IP address or service field blank. FAQ on troubleshooting What are the possible reasons for failed installation of the Firewall Manager? Troubleshoot the problem in the following order: 1. Verify that the software and hardware requirements are met. Preferably, the Firewall Manager is installed on Windows 2003 or Windows XP. 2. Verify that the Firewall Manager of the earlier version, especially its database files, has been uninstalled completely. If you cannot manually delete some of the remnants, reboot the system, and then try to delete them again. 3. Verify that you are privileged to install the Firewall Manager, especially when using Windows 7 or Windows Vista. 4. Check whether the database is damaged after installation (the probability of database damage is very low). If yes, reinstall the Firewall Manager. I cannot access the Firewall Manager page. How to troubleshoot this problem? Troubleshoot the problem in the following order: 1. Verify that you have entered the correct IP address and port number of the Firewall Manager, and your PC and the Firewall Manager server can reach each other. 2. Verify that the Web server is started. 3. Check whether the page is accessible by using other browsers (IE recommended). 4. Restart the Web server. 4

7 5. Initialize the database. (Data will be lost. Try this step only when necessary.) 6. Reinstall the Firewall Manager. (Data will be lost. Try this step only when necessary.) What are the possible reasons for failed addition of devices? Possible reasons are as follows: The device and Firewall Manager are not reachable to each other. The device is not configured with SNMP or SNMP is configured improperly, such as read community string configuration error. Data cannot be displayed normally. How to troubleshoot this problem? Troubleshoot the problem in the following order: 1. Verify that devices are added properly on the Firewall Manager. 2. Capture packets on the Firewall Manager server, and verify that devices send logs to the server and the logs are in correct format. 3. Verify that the time on the Firewall Manager is synchronous with that on the device or time calibration is performed properly when adding the device. 4. Check whether the Firewall Manager has recorded logs in the directory D:\Program Files\Firewall Manager\database\data\rpt, where all log data is stored. The Firewall Manager saves NAT logs to audit_nat_detail files once every hour. The number in the file name indicates the log receiving time. If there is data, the size of each of the two files.myd and.myi is not 0. The following files indicate that NAT logs are received at 16:00 on December 30, 2011: 5