Topic Thread

Expand all | Collapse all

How to send TCP syslog messages from a Fortigate firewall to an ArcSight SIEM environment?

  • 1.  How to send TCP syslog messages from a Fortigate firewall to an ArcSight SIEM environment?

    Posted 01-26-2016 05:56

    I would like to send TCP syslog messages from a Fortigate firewall to an ArcSight SIEM environment.

    I found the following documentation about Fortigate and ArcSight communication, but there is no information about the TCP syslog configuration between this two platforms.

    http://help.fortinet.com/fdb/5-0-0/html/source/concepts/c_dam_notification_tab.html

    Is it possible to send TCP syslog messages (with or without TLS) from Fortigate firewall device to the Arcsight SIEM?



  • 2.  RE: How to send TCP syslog messages from a Fortigate firewall to an ArcSight SIEM environment?

    Posted 01-27-2016 08:30

    Hi,

    # config log syslogd setting

    # set reliable enable

    # end

    Regards,

    Paulo Raponi



  • 3.  RE: How to send TCP syslog messages from a Fortigate firewall to an ArcSight SIEM environment?

    Posted 01-28-2016 07:04

    Can ArcSight be configured to accept that?

    Rgrds,

    Peter



  • 4.  RE: How to send TCP syslog messages from a Fortigate firewall to an ArcSight SIEM environment?

    Posted 01-28-2016 08:57

    Sure. Are the same contend as UDP. The difference are that it need create a session between Fortigate and ArcSight... The traffic inside the TCP session are clear text.



  • 5.  RE: How to send TCP syslog messages from a Fortigate firewall to an ArcSight SIEM environment?

    Posted 01-28-2016 18:08

    Be advised that FortiGate still sends reliable syslog based on RFC 3195, which is obsolete.  This has been an issue with SIEMs that now run reliable syslog based on RFC 5425.  NFR 250344 has been requested to fix this.



  • 6.  RE: How to send TCP syslog messages from a Fortigate firewall to an ArcSight SIEM environment?

    Posted 01-29-2016 05:31

    Thanks you guys for your support, especially for showing this Mantis.

    Rgrds,

    Peter