- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to send TCP syslog messages from a Fortigate firewall to an ArcSight SIEM environment?
I would like to send TCP syslog messages from a Fortigate firewall to an ArcSight SIEM environment.
I found the following documentation about Fortigate and ArcSight communication, but there is no information about the TCP syslog configuration between this two platforms.
http://help.fortinet.com/fdb/5-0-0/html/source/concepts/c_dam_notification_tab.html
Is it possible to send TCP syslog messages (with or without TLS) from Fortigate firewall device to the Arcsight SIEM?
Nominate a Forum Post for Knowledge Article Creation
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
# config log syslogd setting
# set reliable enable
# end
Regards,
Paulo Raponi
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Can ArcSight be configured to accept that?
Rgrds,
Peter
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sure. Are the same contend as UDP. The difference are that it need create a session between Fortigate and ArcSight... The traffic inside the TCP session are clear text.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Be advised that FortiGate still sends reliable syslog based on RFC 3195, which is obsolete. This has been an issue with SIEMs that now run reliable syslog based on RFC 5425. NFR 250344 has been requested to fix this.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks you guys for your support, especially for showing this Mantis.
Rgrds,
Peter