When you configure Shorewall Firewall to send log data to USM Appliance, you can use the Sharewall Firewall plugin to translate raw log data into normalized events for analysis. The table below provides some basic information for the plugin:
|Data Source Name||Shorewall|
|Data Source ID||1877|
Integrating Shorewall Firewall
Before you configure the Shorewall Firewall integration, you must have the IP Address of the USM Appliance Sensor.
To configure Shorewall Firewall to send Syslog messages to USM Appliance
- Open the /etc/shorewall/shorewall.conf file for editing and configure the IP_FORWARDING=[On|Off|Keep] parameter. This parameter determines whether the Shorewall Firewall enables or disables IPV4 Packet Forwarding (/proc/sys/net/ipv4/ip_forward). Possible parameter settings are:
- On or on: Packet forwarding will be enabled.
- Off or off: Packet forwarding will be disabled.
- Keep or keep: The Shorewall Firewall will neither enable or disable packet forwarding. If the IP_FORWARDING parameter is not set, or is set to an empty value, for example, IP_FORWARD="", then IP_FORWARD=On is assumed.
# if you need to forward to other systems as well, just
# add additional config lines:
# Log anything (except mail) of level info or higher.
# Don't log private authentication messages!
# The authpriv file has restricted access.
# Log all the mail messages in one place.
# Log cron stuff
# Everybody gets emergency messages
# Save news errors of level crit and higher in a special file.
# Save boot messages also to boot.log
In this example, we forward all messages to the remote system. By applying different filters, however, you can choose to forward only select entries to the remote system. Note that you can also include as many forwarding actions as you like. For example, if you want to configure a backup central server, you can simply forward log data to both the remote system, and the backup central server, using two different forwarding lines.
For plugin enablement information, see Enable Plugins.
Additional Resources and Troubleshooting
For troubleshooting, refer to the vendor documentation: