User manual ZYXEL P-650R

[. . . ] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 How many devices are supported by VRPT ?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 Which components are included by VRPT ?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 How to install VRPT server on the PC ?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 How to access VRPT ?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 How long will raw data (device logs) be stored in VRPT database ?. . . . . . . . . . . . 5 Application Notes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 General Application Notes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Adding device to device maintenance list of VRPT . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 How to forward device log to VRPT for analysis and report ?. . . . . . . . . . . . . . . . . . . . . . 7 How to enable traffic log feature on ZyWALL ? [. . . ] VRPT includes a Kiwi syslog receiver for collecting device log, MySQL database for storing the log for further analysis, an analysis/reporting module to generate report according to user's request and schedule setting, tomcat web server to provide user-friendly interface. Please refer the hardware/software requirement and quick start guide (QSG) for installation procedure. Just to remind that VRPT installation wizard will install KiWi syslog/MySQL/Tomcat on your computer. If you can not see the window, please check your browser setting and make sure pop-up is not blocked. 4 All contents copyright (c) 2005 ZyXEL Communications Corporation. ZyWALL P1 Support Notes Default username/password is root/root. VRPT will keep only those logs which are within the value. Old logs will be purged from system and saved as CSV file. These CSV files will be located under <VRPT installation directory> (default C:\Program Files\ZyXEL\Vantage Report) \backup. Raw data (CSV files) can be imported to VRPT database through System>>CSV Import. 5 All contents copyright (c) 2005 ZyXEL Communications Corporation. ZyWALL P1 Support Notes Application Notes General Application Notes Adding device to device maintenance list of VRPT VRPT 2. 2 supports multiple devices. User can decide to generate reports for each single device or all devices. First of all, the devices must be added to device maintenance list of VRPT Device>>Device Maintenance. Logs from these devices will be analyzed and imported to VRPT database. If the device doesn't exist in this list, its log will be dropped by VRPT. (User still can see the log on Kiwi). 6 All contents copyright (c) 2005 ZyXEL Communications Corporation. ZyWALL P1 Support Notes If user needs to generate a report on a specific device, please click on "Settings" on the related report. Only those devices in device maintenance will be shown in the drop-down list. User can check the devID attribute in Kiwi syslog. How to forward device log to VRPT for analysis and report ?Therefore, user has to configure VRPT server as the Syslog server on device. (1) From GUI (eWC) For ZyWALL, enter LOGS>>Log Settings to enable the Syslog logging and key in the server name or the IP address of VRPT server. 7 All contents copyright (c) 2005 ZyXEL Communications Corporation. ZyWALL P1 Support Notes The setting of Log Facility doesn't matter for VRPT report. For IDP10, enter REPORT>>Syslog and key in the server name or the IP address of VRPT server. (2) From SMT (Telnet/Console) menu24. 3. 2 (only for ZyWALL, not IDP10) 8 All contents copyright (c) 2005 ZyXEL Communications Corporation. ZyWALL P1 Support Notes Menu 24. 3. 2 - System Maintenance - Syslog Logging Syslog: Active= Yes Syslog Server IP Address= 172. 25. 21. 77 Log Facility= Local 1 How to enable traffic log feature on ZyWALL ?Note that traffic log is only available for ZyWALL 5/35/70 with firmware 3. 63 and later. (1) From GUI (eWC) Enter Logs>>Reports and select "Send Raw Traffic Statistics to Syslog Server for Analysis" (2) From SMT (Telnet/Console) menu 24. 3. 2 Enter its SMT Menu24. 8 and type: sys log load sys log cat traffic 1 sys log save 9 All contents copyright (c) 2005 ZyXEL Communications Corporation. ZyWALL P1 Support Notes VRPT Server Setup Setup VRPT could be very easy. VRPT server generates the report accordingly. configure ZywALL/IDP10 to send syslog to VRPT. 10 All contents copyright (c) 2005 ZyXEL Communications Corporation. ZyWALL P1 Support Notes Add devices into list. 11 All contents copyright (c) 2005 ZyXEL Communications Corporation. ZyWALL P1 Support Notes If device logs are received by Kiwi but not imported into VRPT database (not feasible in Log Monitor), check if the device is registered under device maintenance list. User can check the devID attribute in Kiwi syslog. Advanced Application Notes Using Schedule Report VRPT provides support for emailing and archiving daily and weekly reports. [. . . ] It provides reports based on Intrusion Source (attacker), Destination (victim), type, signature and severity. Following is an example to illustrate that an internal host is conducting network treat (e. g. Configure VRPT Server as the Syslog Server (Report>>Syslog) of IDP10 Step 2. When IDP10 detects intrusion events, it will generate syslog and forward to VRPT Server. 15 All contents copyright (c) 2005 ZyXEL Communications Corporation. ZyWALL P1 Support Notes Step 3. [. . . ]