Identity-Based Traffic Logging and Reporting

Transcription

1 Application Note Identity-Based Traffic Logging and Reporting Using UAC in Conjunction with NSM and Infranet Enforcers to Give Additional, User-Identified Visibility into Network Traffic Juniper Networks, Inc North Mathilda Avenue Sunnyvale, California USA JUNIPER Part Number: Nov 2007

2 Table of Contents Introduction... 3 Scope Design Considerations... 3 Description and Deployment Scenario... 3 Summary About Juniper Networks Copyright 2007, Juniper Networks, Inc.

3 Introduction Scope The combination of Juniper Networks Unified Access Control (UAC) and Juniper Networks NetScreen-Security Manager (NSM) gives you a more enlightening look at your network traffic. With the addition of an Infranet Controller to an existing Juniper firewall deployment, network traffic can be easily identified by the user who created it. Previously, network traffic was identified strictly by a combination of IP addresses and ports. The identity of the user responsible for the network traffic was difficult to obtain without a significant correlation effort. Now traffic within the NSM traffic log can be tagged with the username and roles of the user who generated that traffic. This application note will describe how to configure NSM and the Infranet Enforcers to provide user-identified traffic logs and UAC-specific reports. Design Considerations To generate identity-based traffic logs, you need the following: Hardware Requirements Server platform capable of running NSM version R1 or greater (or NSMXpress appliance) Infranet Enforcer(s) capable of running ScreenOS version 6.0.0R1 or greater Infranet Controller models IC4000 or IC6000 Software Requirements Description and Deployment Scenario NetScreen-Security Manager version R1 or greater ScreenOS version 6.0.0R1 or greater Infranet Controller version 2.0R3 or greater In order to use this new feature, you must complete a couple of steps. First and perhaps most obvious, any Infranet Enforcers for which you want to see profiling information must be under the control of NSM. To add an Infranet Enforcer to NSM, use the NSM Graphical User Interface (GUI) and navigate to Device Manager > Security Devices (Figure 1). From there, click the + sign to add a device. Then simply follow the Add Device wizard to add the Infranet Enforcer to NSM. Figure 1: Add Device Copyright 2007, Juniper Networks, Inc. 3

4 Once added to NSM, the Infranet Enforcer should appear under the list of Security Devices. You can verify the device s operational state by mousing over the device icon in the NSM GUI (Figure 2). Figure 2: Device Operational Status Once NSM has successfully connected to the Infranet Enforcer, you need to enable traffic logging on the Infranet Enforcer. This can be accomplished either through the enforcer Web interface or the command line. In the Web interface, navigate to Configuration > Admin > NSM and check the Traffic Logs checkbox (Figure 3). Click the Apply button to save the changes. The CLI command to perform the same function is: set nsmgmt report log traffic enable. Figure 3: Enforcer NSM Configuration 4 Copyright 2007, Juniper Networks, Inc.

5 In addition to enabling the traffic logs, you must enable logging on any Infranet policy for which you want traffic data captured to NSM. Again, this can be accomplished either through the enforcer Web interface or the command line. In the Web interface, navigate to Policies, click on the Edit link for the Infranet policy you wish to change, click the checkbox next to Logging, and then click OK. Your Infranet policies should show the blue Logging icon in the Options column. In the CLI, add the log keyword to all Infranet policies as in: set policy id 9 from Trust to hr Any Any ANY permit infranet-auth log. Figure 4: Enforcer Logging Policies In Infranet Controller software version 2.1 and above, there is a configuration option on the controller that can prevent logging from taking place. Under the UAC > Infranet Enforcer > Resource Access > [POLICY] > ScreenOS Options section, you have the ability to configure which ScreenOS policy options will be enabled on the Infranet Enforcer. If you were to select the options as shown in Figure 5, no logging would take place for any resource to which this policy applies. This can be quite confusing because logging appears to be enabled on the Infranet Enforcer, but will be subsequently disable by the controller. Figure 5: ScreenOS Options Configuration That completes the configuration for getting the traffic logs into NSM. In order to see the additional information provided by UAC, you will need to create a custom Traffic Log Viewer (or you could modify the existing one). To create a new Log Viewer, navigate within NSM to Log Viewer > Predefined > 5-Traffic, right-click and select Save As Figure 6: Log View Creation Copyright 2007, Juniper Networks, Inc. 5

6 In the Save View dialog box, enter a new name (Infranet Traffic) for the view and save the view to the Others folder. Figure 7: Saving the Log View After creating the view, navigate to the Log Viewer > Others and click on Infranet Traffic. You will see a traffic log identical to the predefined one that you just copied. It s now time to make modifications to the view so that you can see the additional information. At the top of the NSM window, go to the View menu and select Choose Columns Figure 8: Choose Columns In the Column Settings dialog box, scroll down to the bottom and check the box next to Roles and User. For both Roles and User, select them and click Move Up several times until User is just below Alert and Roles is just below User, then click OK. You can, of course, customize this view any way you want, but the User and Roles columns are the information we re trying to get at. 6 Copyright 2007, Juniper Networks, Inc.

7 Figure 9: Add User Column Your Infranet Traffic log view should now look something like the picture below. The User column will reflect the username of the person who generated the traffic associated with that particular log entry, and the Roles column will show the UAC roles to which that user was mapped. Figure 10: Infranet Traffic Log Copyright 2007, Juniper Networks, Inc. 7

8 In addition to the username and role correlation in the traffic logs, there are three additional canned UAC reports available in NSM. To find these reports, navigate to Report Manager > UAC Reports. Figure 11: UAC Reports This is the Time Graph of UAC Session Logs. October 9th was an especially busy day compared to the others. Figure 12: Time Graph of UAC Sessions 8 Copyright 2007, Juniper Networks, Inc.

9 Below is the Top 20 Destinations for UAC Logs. There are two local protected resources ( and ), and the rest is Internet traffic. Figure 13: Top 20 Destinations for UAC Finally there is the Top 20 Enforcers (Devices) for UAC Logs report. With only two enforcers configured, this isn t a very impressive report, but becomes more useful the more enforcers it is reporting on. Figure 14: Top 20 Enforcers for UAC Copyright 2007, Juniper Networks, Inc. 9

10 Summary Following the examples in this application note and using the latest versions of NSM, Infranet Enforcers and UAC, you can now identify, track and report on network traffic by user and user role. About Juniper Networks Juniper Networks, Inc. is the leader in high-performance networking. Juniper offers a highperformance network infrastructure that creates a responsive and trusted environment for accelerating the deployment of services and applications over a single network. This fuels highperformance businesses. Additional information can be found at CORPORATE HEADQUARTERS AND SALES HEADQUARTERS FOR NORTH AND SOUTH AMERICA Juniper Networks, Inc North Mathilda Avenue Sunnyvale, CA USA Phone: 888.JUNIPER ( ) or Fax: EUROPE, MIDDLE EAST, AFRICA REGIONAL SALES HEADQUARTERS Juniper Networks (UK) Limited Building 1 Aviator Park Station Road Addlestone Surrey, KT15 2PG, U.K. Phone: 44.(0) Fax: 44.(0) EAST COAST OFFICE Juniper Networks, Inc. 10 Technology Park Drive Westford, MA USA Phone: Fax: ASIA PACIFIC REGIONAL SALES HEADQUARTERS Juniper Networks (Hong Kong) Ltd. 26/F, Cityplaza One 1111 King s Road Taikoo Shing, Hong Kong Phone: Fax: Copyright 2007 Juniper Networks, Inc. All rights reserved. Juniper Networks, the Juniper Networks logo, NetScreen, and ScreenOS are registered trademarks of Juniper Networks, Inc. in the United States and other countries. JUNOS and JUNOSe are trademarks of Juniper Networks, Inc. All other trademarks, service marks, registered trademarks, or registered service marks are the property of their respective owners. Juniper Networks assumes no responsibility for any inaccuracies in this document. Juniper Networks reserves the right to change, modify, transfer, or otherwise revise this publication without notice. To purchase Juniper Networks solutions, please contact your Juniper Networks sales representative at or authorized reseller. 10