Syslog - Juniper SSL VPN

Prerequisites

Identify the LogRhythm System Monitor Agent that will be used for log collection.

Configure the Management Port

The Management Port on the SSL/VPN device must be configured and enabled to send logs via syslog. Configuration can be completed through a serial connection or through the Admin Console.

Configure Through a Serial Port

1. Start a serial console session.
2. Select item 1, System Settings and Tools.
3. Select item 10, Configure Management port.
   The text indicates if the option is enabled or disabled.
4. Enter the network settings for the Management Port as prompted.
5. When prompted to accept changes, type y if they are correct.
   If they are not correct, repeat the process.
6. Close serial console.

Configure Through the Admin Console

1. Ensure the backend management network is already configured.
2. Connect your management network gateway to the SSL/VPN device via the Management Port.
3. In the Admin Console, click System, click Network, and then click Management Port.
4. Click Enabled.
5. Enter port information: IP address, netmask, and default gateway.
6. Click Save Changes.

Configure Juniper SSL and VPN

The SSL/VPN device logs data to text files stored on the device. There are several types of logs that can be collected - Events log, User Access log, Administrator Access log, Sensors log and Client upload log.

To set the SSL/VPN device to send the logs to LogRhythm via syslog, access System, then Log/Monitoring to enable syslog.

Configure LogRhythm for Juniper SSL and VPN

No additional changes are necessary to configure LogRhythm to work with Juniper SSL/VPN.