INS_RL1000GW_REV– 15 Jul 2016 PAGE 52
INSTALLATION AND OPERATION MANUAL
RL1000GW
TECH SUPPORT: 1.888.678.9427
Firewall TCP SCADA Protocols
The following will describe the ComNet structure of syslog messages generated for firewall of IEC
104, DNP3 TCP, MODBUS TCP.
Console message format
The message format when sent to the CLI console is as follow,
{[APP-NAME] [PROCID][Severity] [MSGID] [Time Stamp]} {[MSG]} {STRUCTURED-DATA}
The message structured data includes following information fields,
|S=SEVERITY|SG=VLAN _ ID|SRC=SRC _ IP _ ADDR:SRC _ IP _ PORT|DST=DEST _ IP _ ADDR:DEST _ IP _
PORT|LEN=DATA _ MSG _ LEN|TTL=TTL|PROTO=PRTOCOL _ NAME|MSG=VIOLATION _ DESCR|
Examples of messages received at the CLI
(Use the command “firewall log show” at the ACE to retrieve following log entries.)
1. Example for violation type “no rule configured”
- RF _ Syslog : module 3 (firewall) severity 3 message : firewall
- |ID=74|T=2014-05-12,11:52:43
|S=E|SG=3500|SRC=172.18.212.50:52011|DST=172.18.212.46:2404|LEN=56|TTL=128|PROTO=iec104|MSG=[0x100]
[45,0]:FW RULE - no rule configured| (164 bytes)
2. Example for violation type “protocol type mismatch”
- RF _ Syslog : module 3 (firewall) severity 1 message : firewall
- |ID=80|T=2014-05-12,11:52:59
|S=A|SG=3500|SRC=172.18.212.50:52011|DST=172.18.212.46:2404|LEN=56|TTL=128|PROTO=iec104|MSG=[0x101]
[45,0]:FW PROTOCOL protcol type missmatch| (170 bytes)
Server message format
The message format when sent to a SYSLOG server is,
{<PRI> [Host IP] [Time Stamp] [APP-NAME]} {MSG} {STRUCTURED-DATA}
The message structured data includes following information fields,
|S=SEVERITY|SG=VLAN _ ID|SRC=SRC _ IP _ ADDR:SRC _ IP _ PORT|DST=DEST _ IP _ ADDR:DEST _ IP _
PORT|LEN=DATA _ MSG _ LEN|TTL=TTL|PROTO=PRTOCOL _ NAME|MSG=VIOLATION _ DESCR|
Examples of messages received at a server
