Enterasys Security Information and Event Manager, Руководство по настройке

Страница: 195 / 426

Configuring DSMs
Juniper JunOS 179
Configuring Juniper
Networks NSM in
SIEM
To configure SIEM to integrate with a Juniper Networks NSM device:
Step 1
From the Log Source Type drop-down list box, select Juniper Networks
Network and Security Manager .
Step 2
From the Protocol Configuration drop-down list box, select Juniper NSM .
Step 3
Configure the following values for the Juniper NSM protocol:
NOTE
In the SIEM interface, the Juniper NSM protocol configuration enables you to use
the Juniper Networks NSM IP address by selecting the Use NSM Address for
Event Source check box. If you wish to change the configuration to use the
originating IP address (clear the check box), you must log in to your SIEM
Console, as a root user, and reboot the Console (for an all-in-one system) or the
Event Collector hosting the log sources (in a distributed environment) using the
following command:
shutdown -r now
Juniper JunOS
A SIEM Juniper JunOS Platform DSM accepts events using syslog,
structured-data syslog, or PCAP (SRX-Series only). SIEM records all valid syslog
or structured-data syslog events.
The SIEM Juniper JunOS Platform DSM supports the following Juniper devices
running JunOS:
•
Juniper M-Series Multiservice Edge Routing
•
Juniper MX-Series Ethernet Services Router
• Juniper T-Series Core Platform
•
Juniper SRX-Series Services Gateway
Table 36-6 Juniper NSM Protocol Parameters
Parameter Description
Log Source Identifier Type the IP address or hostname for the log source.
The log source identifier must be unique for the log source
type.
IP Type the IP address or hostname of the Juniper Networks
NSM server.
Inbound Port Type the inbound port to which the Juniper Networks NSM
sends communications.The valid range is 0 to 65536. The
default is 514.
Redirection Listen
Port Type the port to which traffic is forwarded. The valid range is
0 to 65,536. The default is 516.
Use NSM Address for
Log Source Select this check box if you want to use the Juniper NSM
management server’s IP address instead of the log source’s
IP address. By default, the check box is selected.