How do I send syslogs from a UTM/switch to a cloud-hosted log server?

Question

I'm a small MSP trying to start a logging solution for my clients via a cloud-based log server SaaS provider. I'm not understanding, however, based on any of the instructions I've read from the various products I've tested how to actually accomplish the task.

I've got SonicWALLs, Dell switches, Juniper switches, etc. that I need to send logs from on a daily basis. I see that they have a spot for your syslog server in the GUI (although I'm trying to learn/accomplish this via CLI) however I'm not receiving any logs.

Is there some type of file that needs to be edited in the switch itself? I noticed on one of the switches there was a syslog file.

Answer 1

You may be running into the fact that some firewalls only allow syslog to be sent from them via their management interface (and not directly out the port facing towards your SaaS/logging provider).

Aside from that, syslog will be sent to a remote server via UDP port 514 by default - ensure that this is allowed outbound from your firewall for all your internal switch IP addresses (again you may need to confirm that your switch is sending from the IP address you think it is - particularly if it is also and L3 switch).

If you are using a SaaS provider, they may require that you send to a specific (non-default) syslog port too so that they can separate your flows from those of other customers, so check with them on this too.

Answer 2

Configure the level of syslog's you want for the events you want logged. Then configure the syslog server address - either a static public IP or a FQDN. Then configure the security/firewall on your private/shared cloud system to allow syslog packets to reach the logging server.

Answer 3

You will want to log over a VPN tunnel to protect your clients' data. What I've done is set up the tunnel between the customer's edge UTM/firewall appliance and a virtual one on my cloud. They could route from their management network to the tunnel, using the firewall policy to lock down access to syslog traffic.

Setting up the devices for remote logging largely depends on the vendor and model, a Fortigate does it very differently than an SRX, so check the manuals.

Be aware that some devices insist on using a proprietary logging system that's incompatible with syslog. I've worked with a web proxy that favored a proprietary logging system that would only work with a special monitoring appliance, and the only other option was to upload its logs hourly to our loghost using FTPS (noooo, not SFTP, that would be too easy).