Re: Juniper NSM and secure log forwarding

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Hi, Jon -

Thanks for the response. I see that I wasn't entirely clear. I was aware
that incoming logs from managed devices enter NSM via the encrypted SSP.
Also, clearly I was misinformed about the role that postgreSQL plays in
NSM internals.

> Logs forwarded by NSM via the "Action Manager" will be sent in
> clear-text though as we use standard syslog or SNMP-Trap formats for
> this function.

It's this bit I'm wondering about. What if I want to export firewall
logs via encrypted syslog. Is there a Juniper knowledgebase article I
missed somewhere along the way or do I need to roll my own solution?

Cheers,
- --Trey

Quoth Jon [01/19/2010 09:49 PM] :
> From a Juniper Systems Engineer:
> 
> First, all logs sent to NSM either via SSP or DMI are encrypted.
> 
> Second, we don't use postgreSQL to store firewall logs, only profiler data.
> We have a proprietary logDb that uses a flat-file, compressed format for
> the logs.  The logs are not stored in an encrypted format, but the files
> are owned by the "nsm" account, so you would need the credentials for
> "nsm" or "root" to access them.
> 
> Logs forwarded by NSM via the "Action Manager" will be sent in
> clear-text though as we use standard syslog or SNMP-Trap formats for
> this function.
> 
> Regards,
> Jon
> (Disclosure - I work for Juniper)
> 
> 
> On Tue, Jan 19, 2010 at 11:33 AM, Trey Darley <[email protected]
> <mailto:[email protected]>> wrote:
> 
>     Hi, y'all -
> 
>     Looking for suggestions as to how you've integrated NSM into your
>     logging
>     environment. While it appears not to support ssl-wrapping syslog, it
>     does
>     store it's logs internally in postgresql. Before I go hammering up a
>     cockeyed solution I thought I'd ask the hive.
> 
>     Cheers,
>     --Trey
> 
> 
> 
>     _______________________________________________
>     firewall-wizards mailing list
>     [email protected]
>     <mailto:[email protected]>
>     https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards
> 
> 
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/

iEYEARECAAYFAktWJr8ACgkQQXaSM49tivDPgQCfQHGNbA5plHE8D+2EVWOxCyzT
mykAnj8jmhO6dNzuVhHMUNfamtCm4sfa
=6VLD
-----END PGP SIGNATURE-----