System log
112
System Administrator’s Guide
Access logging
It is possible to log any traffic that arrives at or traverses the Shiva VPN Gateway. The
only logging that is enabled by default is to take note of packets that were dropped.
While it is possible to specifically log exactly which rule led to such a drop, this is not
configured by default. All rules in the default security policy drop packets. They never
reject them. That is, the packets are simply ignored, and have no responses at all
returned to the sender. It is possible to configure reject rules if so desired.
All traffic logging performed on the Shiva VPN Gateway creates entries in the syslog
(/var/log/messages - or external syslog server) of the following format:
<Date/Time> klogd: <prefix> IN=<incoming interface> OUT=<outgoing
interface> MAC=<dst/src MAC addresses> SRC=<source IP> DST=<destination
IP> SPT=<source port> DPT=<destination port> <additional packet info>
Where:
Depending on the type of packet and logging performed some of the fields may not
appear.
Commonly used interfaces are:
The firewall rules deny all packets arriving from the WAN port by default. There are a
few ports open to deal with traffic such as DHCP, VPN services and similar. Any traffic
that does not match the exceptions however is dropped.
There are also some specific rules to detect various attacks (smurf, teardrop, etc.).
When outbound traffic (from LAN to WAN) is blocked by custom rules configured in
the GUI, the resultant dropped packets are also logged.
The <prefix> for all these rules is varied according to their type.
<prefix>
if non-empty, hints at cause for log entry
<incoming interface>
will be empty, or one of eth0, eth1 and similar
<outgoing interface>
as per incoming interface
<dst/src MAC addresses>
MAC addresses associated with the packet
<source IP>
packet claims it came from this IP address
<destination IP>
packet claims it should go to this IP address
<source port>
packet claims it came from this TCP port
<destination port>
packet wants to go to this TCP port
eth0
the LAN port
eth1
the WAN/Internet port
pppX
e.g. ppp0 or ppp1 - a PPP session
ipsecX
e.g. ipsec0, an IPSec interface
Summary of Contents for SHIVA 1100
Page 38: ...QoS traffic shaping 38 System Administrator s Guide...
Page 44: ...DHCP relay 44 System Administrator s Guide...
Page 66: ...Access control 66 System Administrator s Guide...
Page 122: ...Technical Support 122 System Administrator s Guide...
Page 132: ...132 System Administrator s Guide...