Traffic logging JUNOS - Revision history

Rael at 20:55, 12 January 2015

2015-01-12T20:55:19Z

Rael at 20:54, 12 January 2015

2015-01-12T20:54:50Z

Rael: /* /var/log/traffic-log */

2015-01-12T20:54:11Z

‎/var/log/traffic-log

Rael: Created page with "For at lave logning af trafik igennem en SRX firewall, skal der oprettes en logfil hvor alle logbeskeder der indeholder RT_FLOW_SESSION gemmes i. Og derefter sættes session logg..."

2015-01-12T20:53:28Z

Created page with "For at lave logning af trafik igennem en SRX firewall, skal der oprettes en logfil hvor alle logbeskeder der indeholder RT_FLOW_SESSION gemmes i. Og derefter sættes session logg..."

New page

For at lave logning af trafik igennem en SRX firewall, skal der oprettes en logfil hvor alle logbeskeder der indeholder RT_FLOW_SESSION gemmes i. Og derefter sættes session logging på firewall politikken.
=Logfil=
<source lang=cli>
[edit]
root@SRX07# <input>show system syslog file traffic-log</input>
any any;
match <notice>RT_FLOW_SESSION</notice>;
</source>
=Policy logging=
Logningen kan ske når:
#sessionen oprettes med session-init(anbefales ved lange sessioner)
#Sessionen termineres med session-close(anbefales ved permit, da den indeholder mest information)
<source lang=cli>
[edit security policies]
root@SRX07# <input>show</input>
from-zone trust to-zone untrust {
policy trust-to-untrust {
match {
source-address any;
destination-address any;
application any;
}
then {
permit;
<notice>log {
session-close;
}</notice>
}
}
}
</source>
=/var/log/traffic-log=
Filerne bliver hurtigt store, så sørg for at have rigeligt plads og brug logrotate
<source lang=cli>
root@SRX07# <input>run show log traffic-log?</input>
Possible completions:
<filename> Name of log file
traffic-log Size: <notice>106919</notice>, Last changed: Jan 12 21:51:13
traffic-log.0.gz Size: 9276, Last changed: Jan 12 21:45:00

root@SRX07# <input>run show log traffic-log | last</input>
Jan 12 21:52:36 SRX07 RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed response received: 192.168.1.2/35988->8.8.8.8/1 icmp 10.0.0.26/18013->8.8.8.8/1 source-nat-rule None 1 trust-to-untrust trust untrust 23769 1(60) 1(60) 3 UNKNOWN UNKNOWN N/A(N/A) vlan.0 UNKNOWN
Jan 12 21:52:38 SRX07 RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed response received: 192.168.1.2/35989->8.8.8.8/1 icmp 10.0.0.26/18154->8.8.8.8/1 source-nat-rule None 1 trust-to-untrust trust untrust 23770 1(60) 1(60) 4 UNKNOWN UNKNOWN N/A(N/A) vlan.0 UNKNOWN
Jan 12 21:52:38 SRX07 RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed response received: 192.168.1.2/35990->8.8.8.8/1 icmp 10.0.0.26/18419->8.8.8.8/1 source-nat-rule None 1 trust-to-untrust trust untrust 23771 1(60) 1(60) 3 UNKNOWN UNKNOWN N/A(N/A) vlan.0 UNKNOWN
Jan 12 21:52:40 SRX07 RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed response received: 192.168.1.2/35991->8.8.8.8/1 icmp 10.0.0.26/24641->8.8.8.8/1 source-nat-rule None 1 trust-to-untrust trust untrust 23772 1(60) 1(60) 4 UNKNOWN UNKNOWN N/A(N/A) vlan.0 UNKNOWN
Jan 12 21:52:40 SRX07 RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed response received: 192.168.1.2/35992->8.8.8.8/1 icmp 10.0.0.26/27105->8.8.8.8/1 source-nat-rule None 1 trust-to-untrust trust untrust 23773 1(60) 1(60) 3 UNKNOWN UNKNOWN N/A(N/A) vlan.0 UNKNOWN
Jan 12 21:52:42 SRX07 RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed response received: 192.168.1.2/35993->8.8.8.8/1 icmp 10.0.0.26/23506->8.8.8.8/1 source-nat-rule None 1 trust-to-untrust trust untrust 23774 1(60) 1(60) 4 UNKNOWN UNKNOWN N/A(N/A) vlan.0 UNKNOWN
Jan 12 21:52:42 SRX07 RT_FLOW: RT_FLOW_SESSION_CLOSE: session closed response received: 192.168.1.2/35994->8.8.8.8/1 icmp 10.0.0.26/32249->8.8.8.8/1 source-nat-rule None 1 trust-to-untrust trust untrust 23775 1(60) 1(60) 3 UNKNOWN UNKNOWN N/A(N/A) vlan.0 UNKNOWN

</source>
i eksemplet pinges 8.8.8.8 kontinuerligt fra en host med IP 192.168.1.2

@@ Line 1: / Line 1: @@
-For at lave logning af trafik igennem en SRX firewall, skal der oprettes en logfil hvor alle logbeskeder der indeholder RT_FLOW_SESSION gemmes i. Og derefter sættes session logging på firewall politikken.<ref>http://kb.juniper.net/InfoCenter/index?page=content&id=KB16509</ref>
+For at lave logning af trafik igennem en SRX firewall, skal der oprettes en logfil hvor alle logbeskeder der indeholder RT_FLOW_SESSION gemmes i. Og derefter sættes session logging på firewall politikken.<ref>[http://kb.juniper.net/InfoCenter/index?page=content&id=KB16509 SRX Getting Started - Configure Traffic Logging (Security Policy Logs)]</ref>
 =Logfil=
 <source lang=cli>

← Older revision		Revision as of 20:54, 12 January 2015
Line 50:		Line 50:
	</source>		</source>
	i eksemplet pinges 8.8.8.8 kontinuerligt fra en host med IP 192.168.1.2		i eksemplet pinges 8.8.8.8 kontinuerligt fra en host med IP 192.168.1.2
		+	=References=
		+	<references />
		+	{{Source cli}}
		+	[[Category:Juniper]]