Enterasys Security Information and Event Manager, Руководство по настройке

Страница: 257 / 426

Configuring DSMs
46 N
OKIA
F
IREWALL
A SIEM Nokia Firewall DSM accepts events using the following methods:
• Integrating Nokia Firewall Using Syslog
•
Integrating Nokia Firewall Using OPSEC
You can integrate Nokia Firewall version NG AI R55 with SIEM.
Integrating Nokia
Firewall Using
Syslog
This method ensures the SIEM Nokia Firewall DSM accepts Nokia events using
syslog. Before you configure SIEM to integrate with a Nokia Firewall device, you
must:
Step 1
Login to the Nokia Voyager user interface.
Step 2
Click Config .
Step 3
Below the System Configuration pane, click System Logging .
Step 4
In the Add new remote IP address to log to field, type the IP address of your SIEM
system.
Step 5
Click Apply .
Step 6
Click Save .
Step 7
Using SSH, or a direct console connection, log in to the Nokia device as an
administrative user.
If the SSH terminal is disabled, you must enable it through the Nokia Voyager web
interface. See your Nokia Voyager documentation.
Step 8
Open the
/var/etc/rc.local
file.
If the file does not exist, you must create the file.
Step 9
Add the following to the file:
$FWDIR/bin/fw log -ftn | /bin/logger -p local1.info &
Step 10
At the terminal prompt, type the following command:
nohup $FWDIR/bin/fw log -ftn | /bin/logger -p local1.info &
Step 11
You are now ready to configure the log source in SIEM.