Juniper Networks SSG Firewall

• What is Discovered and Monitored
• Configuration
• Settings for Access Credentials

What is Discovered and Monitored

Protocol	Information Discovered	Metrics collected	Used for
SNMP	Host name, Hardware model, Network interfaces, Operating system version	Uptime, CPU and Memory utilization, Network Interface metrics (utilization, bytes sent and received, packets sent and received, errors, discards and queue lengths), Firewall connection count	Availability and Performance Monitoring
Telnet/SSH	Running configuration	Configuration Change	Performance Monitoring, Security and Compliance
Syslog	Device type	Traffic log, Admin login activity logs, Interface up/down logs	Availability, Security and Compliance

Event Types

In ADMIN > Device Support > Event, search for "SSG" in the Device Type column to see the event types associated with this device.

Rules

There are no predefined rules for this device.

Reports

There are no predefined reports for this device.

Configuration

SNMP and SSH

Enable SNMP, SSH, and Ping

1. Log in to your firewall's device manager as an administrator.
2. Go to Network > Interfaces > List.
3. Select the interface and click Edit.
4. Under Service Options, for Management Services, select SNMP and SSH.
5. For Other Services, select Ping.

Create SNMP Community String and Management Station IP

1. Go to Configuration > Report Settings > SNMP.
2. If the public community is not available, create it and provide it with read-only access.
3. Enter the Host IP address and Netmask of your FortiSIEM virtual appliance.
4. Select the Source Interface that your firewall will use to communicate with FortiSIEM.
5. Click OK.

You can configure FortiSIEM to communicate with your device, and then initiate discovery of the device. For more information, see "Discovery Settings" and "Setting Credentials" in the User Guide.

Syslog

Modify Policies so Traffic Matching a Policy is Sent via Syslog to FortiSIEM

1. Go to Policies.
2. Select a policy and click Options.
3. Select Logging.
4. Click OK.

Set FortiSIEM as a Destination Syslog Server

1. Go to Configuration > Report Settings > Syslog.
2. Select Enable syslog messages.
3. Select the Source Interface that your firewall will use to communicate with FortiSIEM.
4. Under Syslog servers, enter the IP/Hostname of your FortiSIEM virtual appliance.
5. For Port, enter 514.
6. For Security Facility, select LOCALD.
7. For Facility, select LOCALD.
8. Select Event Log and Traffic Log.
9. Select Enable.
10. Click Apply.

Set the Severity of Syslogs to Send to FortiSIEM

1. Go to Configuration > Report Setting > Log Settings.
2. Click Syslog.
3. Select the Severity Levels of the syslogs you want sent to FortiSIEM.
4. Click Apply.

Sample Parsed FortiGate Syslog

<129>Aug 26 11:09:45 213.181.33.233 20090826, 6219282, 2009/08/26 09:09:40, 2009/08/26 08:09:49, global.CoX, 1363,
CoX-eveTd-fw1, 213.181.41.226, traffic, traffic log, untrust, (NULL), 81.243.104.82, 64618, 81.243.104.82,
64618, dmz, (NULL), 213.181.36.162, 443, 213.181.36.162, 443, tcp, global.CoX, 1363, Workaniser_cleanup, fw/vpn, 34,
accepted, info, no, (NULL), (NULL), (NULL), (NULL), 3, 858, 1323, 2181, 0, 0, 14, 1, no, 0, Not 
				
<129>Aug 26 11:09:45 213.181.33.233 20090826, 6219282, 2009/08/26 09:09:40, 2009/08/26 08:09:49, global.CoX, 1363,
CoX-eveTd-fw1, Category, Sub-Category, untrust, (NULL), 81.243.104.82, 64618, 81.243.104.82, 64618, dmz,
(NULL), 213.181.36.162, 443, 213.181.36.162, 443, tcp, global.Randstad, 1363, Workaniser_cleanup, fw/vpn, 34, accepted,
info, no, (NULL), (NULL), (NULL), (NULL), 3, 858, 1323, 2181, 0, 0, 14, 1, no, 0, Not

Settings for Access Credentials

SNMP Access Credentials for All Devices

Use these Access Method Definition settings to allow FortiSIEM to access your over SNMP. Set the Name and Community String.

Setting	Value
Name	<set name>
Device Type	Generic
Access Protocol	SNMP
Community String	<your own>

Telnet Access Credentials for All Devices

These are the generic settings for providing Telnet access to your device from FortiSIEM.

Setting	Value
Name	Telnet-generic
Device Type	generic
Access Protocol	Telnet
Port	23
User Name	A user who has permission to access the device over Telnet
Password	The password associated with the user

SSH Access Credentials for All Devices

These are the generic settings for providing SSH access to your device from FortiSIEM.

Setting	Value
Name	ssh-generic
Device Type	Generic
Access Protocol	SSH
Port	22
User Name	A user who has access credentials for your device over SSH
Password	The password for the user