Enterasys Security Information and Event Manager, Configuration Manual

Page: 309 / 426

Configuring DSMs
55 R
EDBACK
ASE
The SIEM Redback ASE DSM accepts events using syslog. The Redback ASE
device can send log messages to the Redback device console or to a log server
that is integrated with SIEM to generate deployment specific reports. Before
configuring a Redback ASE device in SIEM, you must configure your device to
send syslog events to SIEM.
To configure the device to send syslog events to SIEM:
Step 1
Log in to your Redback ASE device user interface.
Step 2
Start the CLI configuration mode.
Step 3
In global configuration mode, configure the default settings for the security service:
asp security default
Step 4
In ASP security default configuration mode, configure the IP address of the log
server and the optional transport protocol:
log server <IP address> transport udp port 9345
Where
<IP address>
is the IP address of the SIEM system.
Step 5
Configure the IP address that you want to use as the source IP address in the log
messages:
log source <source IP address>
Where
<source IP address>
is the IP address of the loopback interface in
context local.
Step 6
Commit the transaction.
For more information about Redback ASE device configuration, see your vendor
documentation.
For example, if you want to configure:
•
Log source server IP address 10.172.55.55
• Default transport protocol: UDP
• Default server port: 514
The source IP address used for log messages is 10.192.22.24. This address must
be an IP address of a loopback interface in context local.