| 1 | # SonicWall Syslog Forwarding |
| 2 | |
| 3 | This process involves configuring the SonicWall firewall to send logs to an external syslog server. |
| 4 | |
| 5 | ## Method 1: Direct Syslog Forwarding (UDP/TCP) |
| 6 | |
| 7 | For direct syslog forwarding from SonicWall to your SIEM stack, follow the [SonicWall Syslog Configuration Guide](https://socfortress.supportbench.net/ar-1084/). |
| 8 | |
| 9 | ### Step 1: Accessing the SonicWall Firewall |
| 10 | |
| 11 | Log in to your SonicWall firewall using the web management interface: |
| 12 | |
| 13 | - Open a web browser. |
| 14 | - Navigate to the IP address of the SonicWall unit (e.g., `https://192.168.1.1`). |
| 15 | - Enter your administrative credentials to log in. |
| 16 | |
| 17 | ### Step 2: Configuring Syslog Settings |
| 18 | |
| 19 | Once logged in, follow these steps to configure syslog forwarding: |
| 20 | |
| 21 | - **Navigate to Log Settings** |
| 22 | - Go to **Log** > **Settings** in the left-hand navigation menu. |
| 23 | - Click on the **Syslog** tab. |
| 24 | |
| 25 | - **Enable Syslog** |
| 26 | - Check the box to **Enable Syslog**. |
| 27 | |
| 28 | - **Configure Syslog Server Details** |
| 29 | - **Name or IP Address:** Enter the IP address or hostname of your syslog server. |
| 30 | - **Port:** Specify the port number (default is 514 for UDP, or custom port for TCP). |
| 31 | - **Syslog Format:** Select the syslog format (recommended: **Syslog** or **CEF**). |
| 32 | - **Syslog ID:** (Optional) Enter a unique identifier for this SonicWall device. |
| 33 | |
| 34 | - **Select Log Categories** |
| 35 | - Choose which categories of logs to forward: |
| 36 | - System Maintenance |
| 37 | - System Errors |
| 38 | - Blocked Web Sites |
| 39 | - Blocked Java etc. |
| 40 | - User Activity |
| 41 | - Attacks |
| 42 | - Dropped TCP/UDP/ICMP |
| 43 | - Network Debug |
| 44 | - And any other relevant categories |
| 45 | |
| 46 | - **Configure Advanced Settings (Optional)** |
| 47 | - **Syslog Facility:** Select the facility code (e.g., Local0 through Local7). |
| 48 | - **Display Format:** Choose how the logs should be formatted. |
| 49 | |
| 50 | ### Step 3: Saving the Configuration |
| 51 | |
| 52 | After entering all the necessary configurations: |
| 53 | |
| 54 | - Click **Accept** or **Apply** to save the settings. |
| 55 | - The SonicWall firewall will now start forwarding logs to the specified syslog server. |
| 56 | |
| 57 | ### Step 4: Verify Log Reception |
| 58 | |
| 59 | Check your syslog server to verify that it is receiving logs from the SonicWall firewall. Monitor the logs to ensure proper formatting and categorization. |
| 60 | |
| 61 | --- |
| 62 | |
| 63 | ## Method 2: TLS Encrypted Forwarding via Syslog-NG (Recommended for Production) |
| 64 | |
| 65 | For secure, encrypted log forwarding, use a local syslog-ng collector to receive UDP logs from SonicWall within your local network, then forward them via TLS to your SIEM stack. |
| 66 | |
| 67 | ### Overview |
| 68 | |
| 69 | This method provides: |
| 70 | - **Security:** TLS encryption for logs in transit over the internet |
| 71 | - **Reliability:** Local collection prevents log loss due to network issues |
| 72 | - **Flexibility:** Ability to preprocess or enrich logs before forwarding |
| 73 | |
| 74 | ### Architecture |
| 75 | |
| 76 | ``` |
| 77 | SonicWall (UDP) > Syslog-NG Collector (Local Network) > TLS > SIEM Stack |
| 78 | ``` |
| 79 | |
| 80 | ### Step 1: Deploy Local Log Collector |
| 81 | |
| 82 | Follow the [Local Log Collector using Syslog-NG Guide](https://socfortress.supportbench.net/article/local-log-collector-using-syslog-ng) to set up your local collector. |
| 83 | |
| 84 | The local collector will: |
| 85 | 1. Listen for UDP syslog messages from your SonicWall firewall |
| 86 | 2. Receive logs on the local network (e.g., port 514/UDP) |
| 87 | 3. Encrypt and forward logs via TLS to your SIEM stack |
| 88 | |
| 89 | ### Step 2: Configure SonicWall for Local Collector |
| 90 | |
| 91 | Configure your SonicWall to send logs to the **local syslog-ng collector IP address**: |
| 92 | |
| 93 | - **Navigate to Log Settings** |
| 94 | - Go to **Log** > **Settings** > **Syslog** tab |
| 95 | |
| 96 | - **Configure Local Collector as Syslog Server** |
| 97 | - **Name or IP Address:** Enter the IP address of your local syslog-ng collector |
| 98 | - **Port:** 514 (UDP) or the port configured on your collector |
| 99 | - **Syslog Format:** Syslog or CEF |
| 100 | - Enable relevant log categories |
| 101 | |
| 102 | - **Apply Configuration** |
| 103 | - Click **Accept** to save the settings |
| 104 | |
| 105 | ### Step 3: Configure Syslog-NG for TLS Forwarding |
| 106 | |
| 107 | On your local syslog-ng collector, configure the destination to forward logs via TLS to your SIEM stack: |
| 108 | |
| 109 | - Reference the [Syslog-NG TLS Configuration Guide](https://socfortress.supportbench.net/article/local-log-collector-using-syslog-ng) for detailed steps |
| 110 | - Ensure TLS certificates are properly configured |
| 111 | - Configure the destination with your SIEM stack's IP address and TLS port |
| 112 | |
| 113 | ### Step 4: Verify End-to-End Log Flow |
| 114 | |
| 115 | 1. **Check Local Collection:** Verify syslog-ng is receiving logs from SonicWall |
| 116 | 2. **Check TLS Connection:** Verify syslog-ng establishes TLS connection to SIEM |
| 117 | 3. **Check SIEM Reception:** Verify logs appear in your SIEM stack with proper source identification |
| 118 | |
| 119 | ### Additional Considerations |
| 120 | |
| 121 | - **Certificate Management:** Keep TLS certificates up to date and properly secured |
| 122 | - **Collector High Availability:** Consider deploying redundant collectors for production environments |
| 123 | - **Network Segmentation:** Ensure the local collector is in the same network segment as the SonicWall for optimal performance |
| 124 | - **Firewall Rules:** Ensure: |
| 125 | - SonicWall can reach the local collector on the configured UDP port |
| 126 | - Local collector can reach the SIEM stack on the configured TLS port |
| 127 | - No firewall rules block outbound TLS traffic from the collector |
| 128 | |
| 129 | --- |
| 130 | |
| 131 | ## General Additional Considerations |
| 132 | |
| 133 | - **Security:** For internet-facing log forwarding, always use TLS encryption (Method 2) |
| 134 | - **Backup Configurations:** Always keep a backup of your firewall configurations before making changes |
| 135 | - **Log Volume:** Monitor the volume of logs being generated to ensure your syslog infrastructure can handle the load |
| 136 | - **Time Synchronization:** Ensure all devices (SonicWall, collector, SIEM) have synchronized time using NTP |
| 137 | - **Testing:** Test the configuration in a non-production environment first if possible |