Watchguard Firebox X1000, Руководство пользователя

Страница: 225 / 314

WatchGuard Logging Architecture
User Guide 203
host. For more information, see “Setting up the Watch-
Guard Security Event Processor” on page 207.
WatchGuard Logging Architecture
By default, Policy Manager and the log and notification
application–the WatchGuard Security Event Processor–
are installed on the same computer. You can, however,
install the event processor software on multiple computers.
You must complete the following tasks to configure the
firewall for logging and notification:
Policy Manager
- Add log hosts
- Customize preferences for services and packet
handling options
- Save the configuration file with logging
properties to the Firebox
WatchGuard Security Event Processor (WSEP)
- Install the WSEP software on each log host
- Set global logging and notification preferences for
the host
- Set the log encryption key on each log host
identical to the key set in Policy Manager
Designating Log Hosts for a Firebox
You should have at least one log host to run the Watch-
Guard Firebox System. The default primary log host is the
management station that is set when you run the Quick-
Setup Wizard. You can specify a different primary log host
as well as multiple backup log hosts. The typical medium-
sized operation has two or three high-capacity log hosts.