User manual ZYXEL P-652HW

[. . . ] . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 2 All contents copyright (c) 2005 ZyXEL Communications Corporation. ZyWALL P1 Support Notes FAQ Product FAQ What is Vantage Report (VRPT) ?Vantage Report (VRPT), a web-based centralized reporting system for quickly and conveniently collecting and analyzing a distributed network, provides system administrator a simple and direct method of monitoring multiple ZyWALL Internet security and IDP appliances. VRPT 2. 2 supports Bandwidth usage/Service/Web Filter/Attack/Intrusion/Authentication reports. Administrator can generate a report by online-query or schedule report daily/weekly. [. . . ] Under System>>General Config, user can decide Log store days. VRPT will keep only those logs which are within the value. Old logs will be purged from system and saved as CSV file. These CSV files will be located under <VRPT installation directory> (default C:\Program Files\ZyXEL\Vantage Report) \backup. User can read the CSV file by Microsoft Excel. The naming will be something like auto_20050317000003. csv. It means the log file is formed on 03/17/2005 at 00:00:03. Raw data (CSV files) can be imported to VRPT database through System>>CSV Import. 5 All contents copyright (c) 2005 ZyXEL Communications Corporation. ZyWALL P1 Support Notes Application Notes General Application Notes Adding device to device maintenance list of VRPT VRPT 2. 2 supports multiple devices. User can decide to generate reports for each single device or all devices. First of all, the devices must be added to device maintenance list of VRPT Device>>Device Maintenance. Logs from these devices will be analyzed and imported to VRPT database. If the device doesn't exist in this list, its log will be dropped by VRPT. (User still can see the log on Kiwi). 6 All contents copyright (c) 2005 ZyXEL Communications Corporation. ZyWALL P1 Support Notes If user needs to generate a report on a specific device, please click on "Settings" on the related report. User can select the device according to its Type and Name. Only those devices in device maintenance will be shown in the drop-down list. Note that the LAN MAC address must be correct. User can check the devID attribute in Kiwi syslog. How to forward device log to VRPT for analysis and report ?Therefore, user has to configure VRPT server as the Syslog server on device. (1) From GUI (eWC) For ZyWALL, enter LOGS>>Log Settings to enable the Syslog logging and key in the server name or the IP address of VRPT server. 7 All contents copyright (c) 2005 ZyXEL Communications Corporation. ZyWALL P1 Support Notes The setting of Log Facility doesn't matter for VRPT report. For IDP10, enter REPORT>>Syslog and key in the server name or the IP address of VRPT server. (2) From SMT (Telnet/Console) menu24. 3. 2 (only for ZyWALL, not IDP10) 8 All contents copyright (c) 2005 ZyXEL Communications Corporation. ZyWALL P1 Support Notes Menu 24. 3. 2 - System Maintenance - Syslog Logging Syslog: Active= Yes Syslog Server IP Address= 172. 25. 21. 77 Log Facility= Local 1 How to enable traffic log feature on ZyWALL ?Note that traffic log is only available for ZyWALL 5/35/70 with firmware 3. 63 and later. (1) From GUI (eWC) Enter Logs>>Reports and select "Send Raw Traffic Statistics to Syslog Server for Analysis" (2) From SMT (Telnet/Console) menu 24. 3. 2 Enter its SMT Menu24. 8 and type: sys log load sys log cat traffic 1 sys log save 9 All contents copyright (c) 2005 ZyXEL Communications Corporation. ZyWALL P1 Support Notes VRPT Server Setup Setup VRPT could be very easy. Take following steps to get reports on VRPT. System administrator configure ZywALL/IDP10 to send syslog to VRPT. [. . . ] It will occupy most of the network resource of the company, which may decrease the 14 All contents copyright (c) 2005 ZyXEL Communications Corporation. ZyWALL P1 Support Notes productivity. VRPT supports intrusion report based on the log from ZyWALL IDP10. It provides reports based on Intrusion Source (attacker), Destination (victim), type, signature and severity. Following is an example to illustrate that an internal host is conducting network treat (e. g. [. . . ]