topic Thanks Aastha Bhardwaj, in Network Security

FireSIGHT reporting issue

Md.Jashim Uddin — Tue, 12 Mar 2019 12:52:47 GMT

Hi,

There is an active/Standby Firewall with Sourcefire. Firewall is working well with Failover. But there is no report showing in the FireSIGHT/Defense Center as well as no rule is executed.

Although

1.All license (Protect,Control,FIRESIGHT,AMP,URL) are installed to the sourcefire

2.Rules are created properly.

3.Logging is enabled.

4.Packets are being sent to Sourcefire.

Hi,

Aastha Bhardwaj — Mon, 25 Jan 2016 15:40:05 GMT

Hi,

When you say report what exactly do you mean ? Try looking for Analysis >connection events , if you see the traffic from the active firewall ? Also check the access-list that you have pushed to the active FW does that have logging enabled on the rules ?

Regards,

Aastha Bhardwaj

Rate if that helps!!!

Thanks Aastha Bhardwaj,

Md.Jashim Uddin — Wed, 27 Jan 2016 04:59:42 GMT

Thanks Aastha Bhardwaj,

There are two attached files. I think it will help you. Reporting means there is nothing in Analysis >connection events which is shown in the events_blank.png file.

Here is the Active Firewall Configuration

access-list ACL_ANY extended permit ip any any

class-map SFR
match access-list ACL_ANY

policy-map global_policy

class SFR
sfr fail-open

Hi,

Aastha Bhardwaj — Wed, 27 Jan 2016 06:05:56 GMT

Hi,

On the right hand top corner the time window that is there , can you change the time to say 1 day or 1 week and see if you see the connection events , currently it is set to 1 hr.

Regards,

Aastha Bhardwaj

Rate if that helps!!!

Thanks Aastha Bhardwaj,

Md.Jashim Uddin — Fri, 29 Jan 2016 02:45:45 GMT

Thanks Aastha Bhardwaj,

After restating the Esxi, its OK now.