fortigate vpn auth logs config changes #712
Conversation
| @@ -210,12 +210,12 @@ EXTRACT-src_ip_for_radius = \sfrom \'(?<src_ip>[^\']+)\', | |||
|
|
|||
| [fgt_event] | |||
| # fgt_event for old Fortigate Add-on (1.6.2) | |||
| EVAL-dest_category = if(subtype="vpn" AND vendor_action IN ("negotiate", "ssl-login-fail"), "vpn_auth", dest_category) | |||
| EVAL-dest_category = if(subtype="vpn" AND vendor_action IN ("tunnel-up", "ssl-login-fail"), "vpn_auth", dest_category) | |||
There was a problem hiding this comment.
Just tunnel-up won't work, because tunnel-up also includes Network tunnels, which is not expected.
We need to use logdesc or other fields to limit the right VPN login data.
| @@ -31,7 +31,7 @@ search = sourcetype="pan:system" object="RSA_Radius" dest_category="radius_auth" | |||
| ### Fortigate VPN ### | |||
| ##################### | |||
| [cs_fortigate_vpn_auth] | |||
| search = sourcetype IN ("fgt_event", "fortigate_event") subtype="vpn" vendor_action IN ("negotiate", "ssl-login-fail") | |||
| search = sourcetype IN ("fgt_event", "fortigate_event") subtype="vpn" vendor_action IN ("tunnel-up", "ssl-login-fail") | |||
There was a problem hiding this comment.
Need the change here as well.
|
|
||
|
|
||
| [fortigate_event] | ||
| # fortigate_event for the new Fortigate Add-on (1.6.5) | ||
| EVAL-dest_category = if(subtype="vpn" AND vendor_action IN ("negotiate", "ssl-login-fail"), "vpn_auth", dest_category) | ||
| EVAL-dest_category = if(subtype="vpn" AND ((vendor_action="tunnel-up" reason="login successfully") OR vendor_action="ssl-login-fail"), "vpn_auth", dest_category) | ||
| # Note - eval action is not working because Fortigate Add-on's lookup is overriding the action field, hence we need to make changes in the data-model definition | ||
| # action field update in the Authentication data-model -> case(sourcetype="fgt_event" AND subtype="vpn" AND vendor_action IN ("tunnel-up", "phase2-up"), "success", sourcetype="fgt_event" AND subtype="vpn" AND vendor_action="ssl-login-fail", "failure", isnull(action) OR action="", "unknown", 1==1, action) |
There was a problem hiding this comment.
Do we need to change this as per new logic for action field - failure & success?
There was a problem hiding this comment.
as per note, action field is overriding from fortigate addon. so I'm testing it and after will change.
There was a problem hiding this comment.
Let's write a note here that fortigate Add-on is overriding the action field, hence we are not writing the props config here and instead writing it in the data-model & dashboard queries.
| @@ -231,7 +232,7 @@ | |||
| <table> | |||
| <title>Successful Session</title> | |||
| <search> | |||
| <query>`cs_vpn_indexes` dest_category="vpn_auth" action="success" user IN $User$ dest=$tkn_dest$ src=$tkn_public_ip$ | |||
| <query>`cs_vpn_indexes` dest_category="vpn_auth" action="added" user IN $User$ dest=$tkn_dest$ src=$tkn_public_ip$ | |||
There was a problem hiding this comment.
We need to put only specific tunnel-down, just like tunnel-up
|
|
||
|
|
||
| [fortigate_event] | ||
| # fortigate_event for the new Fortigate Add-on (1.6.5) | ||
| EVAL-dest_category = if(subtype="vpn" AND vendor_action IN ("negotiate", "ssl-login-fail"), "vpn_auth", dest_category) | ||
| EVAL-dest_category = if(subtype="vpn" AND ((vendor_action="tunnel-up" reason="login successfully") OR vendor_action="ssl-login-fail"), "vpn_auth", dest_category) | ||
| # Note - eval action is not working because Fortigate Add-on's lookup is overriding the action field, hence we need to make changes in the data-model definition | ||
| # action field update in the Authentication data-model -> case(sourcetype="fgt_event" AND subtype="vpn" AND vendor_action IN ("tunnel-up", "phase2-up"), "success", sourcetype="fgt_event" AND subtype="vpn" AND vendor_action="ssl-login-fail", "failure", isnull(action) OR action="", "unknown", 1==1, action) |
There was a problem hiding this comment.
Let's write a note here that fortigate Add-on is overriding the action field, hence we are not writing the props config here and instead writing it in the data-model & dashboard queries.
No description provided.