Enterasys Security Information and Event Manager, Configuration Manual

Page: 198 / 426

Configuring DSMs
182 J
UNIPER
N
ETWORKS
For more information on configuring log sources, see the Log Sources User Guide .
For more information about your Juniper device, see your vendor documentation.
Configuring Juniper
Networks SRX-series
PCAP Protocol
The Juniper SRX-series appliance supports forwarding of packet capture (PCAP)
and syslog data to SIEM. Syslog data is forwarded to SIEM on port 514. The IP
address and outgoing PCAP port number is configured on the Juniper Networks
SRX-series appliance interface. The Juniper Networks SRX-series appliance must
be configured using the to forward PCAP data in the format
<IP Address>
:
<Port>
.
Where:
<IP Address>
is the IP address of SIEM.
<Port>
is the outgoing port address for the PCAP data.
For more information on Configuring Packet Capture, see your Juniper Networks
JunOS documentation.
You are now ready to configure the log source and protocol in SIEM. For more
information see
Configuring a New Juniper Networks SRX Log Source with PCAP .
Configuring a New Juniper Networks SRX Log Source with PCAP
The Juniper Networks SRX-series appliance is auto discovered by SIEM as a
Juniper JunOS Platform. SIEM detects the syslog data and adds the log source
automatically. The PCAP data can be added to SIEM as Juniper SRX-series
Services Gateway log source using the PCAP Syslog Combination protocol.
Adding the PCAP Syslog Combination protocol after SIEM auto discovers the
JunOS syslog data adds an additional log source to your existing log source limit.
Deleting the existing syslog entry, then adding the PCAP Syslog Combination
protocol adds both syslog and PCAP data as single log source.
To configure SIEM to access the Juniper Networks SRX-series as a single log
source:
Step 1
Log in to SIEM.
Step 2
Click the Admin tab.
Step 3
In the navigation menu, click Data Sources .
The Data Sources pane is displayed.
Step 4
Click the Log Sources icon.
The Log Sources window is displayed.
NOTE
You must install the latest PCAP Protocol from the Enterasys Extranet before
configuring the PCAP log source. For information on installing a protocol, see the
Log Sources User Guide.
Step 5
Click Add .