F5 Networks BIG-IP AFM

Configuring a Logging Pool

A logging pool is used to define a pool of servers that receive syslog events. The pool contains the IP address, port, and a node name that you provide.

1. From the navigation menu, select Local Traffic >Pools.

2. Click Create.

3. In the Name field, type a name for the logging pool.

   For example, Logging_Pool.

4. From the Health Monitor field, in the Available list, select TCP and click <<.

   This clicking action moves the TCP option from the Available list to the Selected list.

5. In the Resource pane, from the Node Name list, select Logging_Node or the name you defined in step 3.

6. In the Address field, type the IP address for the JSA console or Event Collector.

7. In the Service Port field, type 514.

8. Click Add.

9. Click Finish.

Creating a High-speed Log Destination

The process to configure logging for BIG-IP AFM requires that you create a high-speed logging destination.

1. From the navigation menu, select System >Logs >Configuration >Log Destinations.

2. Click Create.

3. In the Name field, type a name for the destination.

   For example, Logging_HSL_dest.

4. In the Description field, type a description.

5. From the Type list, select Remote High-Speed Log.

6. From the Pool Name list, select a logging pool from the list of remote log servers.

   For example, Logging_Pool.

7. From the Protocol list, select TCP.

8. Click Finish.

Creating a Formatted Log Destination

The formatted log destination is used to specify any special formatting that is required on the events that are forwarded to the high-speed logging destination.

1. From the navigation menu, select System >Logs >Configuration >Log Destinations.

2. Click Create.

3. In the Name field, type a name for the logging format destination.

   For example, Logging_Format_dest.

4. In the Description field, type a description.

5. From the Type list, select Remote Syslog.

6. From the Syslog Format list, select Syslog.

7. From the High-Speed Log Destination list, select your high-speed logging destination.

   For example, Logging_HSL_dest.

8. Click Finished.

Creating a Log Publisher

Creating a publisher allows the BIG-IP appliance to publish the formatted log message to the local syslog database.

1. From the navigation menu, select System >Logs >Configuration >Log Publishers.

2. Click Create.

3. In the Name field, type a name for the publisher.

   For example, Logging_Pub.

4. In the Description field, type a description.

5. From the Destinations field, in the Available list, select the log destination name that you created in Configuring a Logging Pool and click << to add items to the Selected list.

   This clicking action moves your logging format destination from the Available list to the Selected list. To include local logging in your publisher configuration, you can add local-db and local-syslog to the Selected list.

Creating a Logging Profile

Use the Logging profile to configure the types of events that your Advanced Firewall Manager is producing and to associate these events with the logging destination.

1. From the navigation menu, select Security >Event Logs >Logging Profile.

2. Click Create.

3. In the Name field, type a name for the log profile.

   For example, Logging_Profile.

4. In the Network Firewall field, select the Enabled check box.

5. From the Publisher list, select the log publisher that you configured.

   For example, Logging_Pub.

6. In the Log Rule Matches field, select the Accept, Drop, and Reject check boxes.

7. In the Log IP Errors field, select the Enabled check box.

8. In the Log TCP Errors field, select the Enabled check box.

9. In the Log TCP Events field, select the Enabled check box.

10. In the Storage Format field, from the list, select Field-List.

11. In the Delimiter field, type , (comma) as the delimiter for events.

12. In the Storage Format field, select all of the options in the Available Items list and click <<.

    This clicking action moves all of the Field-List options from the Available list to the Selected list.

13. In the IP Intelligence pane, from the Publisher list, select the log publisher that you configured.

    For example, Logging_Pub.

14. Click Finished.

Associating the Profile to a Virtual Server

The log profile you created must be associated with a virtual server in the Security Policy tab. This association allows the virtual server to process your network firewall events, along with local traffic.

Take the following steps to associate the profile to a virtual server.

1. From the navigation menu, select Local Traffic >Virtual Servers.

2. Click the name of a virtual server to modify.

3. From the Security tab, select Policies.

4. From the Log Profile list, select Enabled.

5. From the Profile field, in the Available list, select Logging_Profile or the name you specified in Creating a Logging Profile and click <<.

   This clicking action moves the Logging_Profile option from the Available list to the Selected list.

6. Click Update to save your changes.

   The configuration is complete. The log source is added to JSA as F5 Networks BIG-IP AFM syslog events are automatically discovered. Events that are forwarded to JSA by F5 Networks BIG-IP AFM are displayed on the Log Activity tab of JSA.

Syslog Log Source Parameters for F5 Networks BIG-IP AFM

If JSA does not automatically detect the log source, add a F5 Networks BIG-IP AFM log source on the JSA Console by using the syslog protocol.

When using the syslog protocol, there are specific parameters that you must use.

The following table describes the parameters that require specific values to collect syslog events from F5 Networks BIG-IP AFM:

F5 Networks BIG-IP AFM Sample Event Message

Use this sample event message to verify a successful integration with JSA.