So now that we have the 40 Analyzer verified, it's reachable by our management
computer.
Let me walk you through how we can add individual devices like 40 gate firew
alls to send their
logging information and event information over to the 40 Analyzer. So at the
moment,
I currently have firewall one and also the branch firewall here, both setting
their log
information over to the 40 Analyzer. But what isn't happening is I don't have
firewall two or
firewall three yet setting their log information over. So it's really simple to
both tell these
firewalls to send the logs. It's also very simple to sell the 40 Analyzer to WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
firewalls to send the logs. It's also very simple to sell the 40 Analyzer to
welcome those incoming
logs. So let's demonstrate that right now. So this is the 40 Analyzer and
currently to see who is
sending logs to this device, we go to device manager. And with device manager
selected,
it's showing us that we have hg firewall one, and also this device over at dot
71 on my management
network, which is the branch firewall that's saying it over as well. And
because this firewall
right here is part of a h a cluster. That's why it's showing up with this name
right here cluster WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
right here cluster
one fgd 60 f also I thought it'd be interesting to go ahead and have firewall
one here with a feature
release seven six and the firewall over at the branch office is currently 748,
which is the as of
this recording, one of the more mature versions available for the 40 us. So
again, what's not here
is firewall two and firewall three. And just to confirm where they are on the
topology firewall
two is right here. And firewall three is right here. And my 192 168 one
management network is
consistent across the rest. So firewall two ends in dot 52 for its management WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
consistent across the rest. So firewall two ends in dot 52 for its management
interface,
firewall three ends in dot 53. So with that in mind, let's go over to firewall
two and firewall three
and tell them to start sending their logs over to the 40 analyzer. So here is
firewall two just at
the top left there shows us the actual name at hq firewall two. And now to tell
this firewall
firewall to to start sending log and event messages over to the 40 analyzer, we
're going to go
down to security fabric, and then we're going to click on external connectors.
So here on firewall
two, we're going to go down to security fabric and click on fabric connectors. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
two, we're going to go down to security fabric and click on fabric connectors.
And here for logging
and analytics, currently, we're not logging to a 40 analyzer. So we'll click
here, then click on
edit, and then specify for 40 analyzer, we want to enable logging, and then we
'll specify where
we're going to log to, and we'll put in the IP address that's reachable on our
measurement network,
which is 192 dot 168 dot 1 dot 81. And then let's go ahead and say real time
uploads. And that way,
when something happens at this 40 gate regarding logs and events, it can
immediately send them
over. And then we'll click on, okay, 40 analyzer needs to approve and authorize WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
over. And then we'll click on, okay, 40 analyzer needs to approve and authorize
the inbound
messages from firewall two. So that's an additional step that needs to happen
as well. So we'll take
care of that as well. So I'll click on accept here. And let's go on to firewall
three and tell
it also to start sending log information over to the 40 analyzer. So here we
are at firewall three. I
did slightly change the color coding here. So that's easy to recognize it's a
different firewall.
So we're on firewall three. Once again, we go down to security fabric, and then
we go to fabric
connectors. And then here in the section called logging and analytics, we'll go
ahead and click on WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
ahead and click on
that, and then click on edit, and then specify one to enable 40 analyzer
logging, and then specify
the IP address of our 40 analyzer, which is 192.168.1.81. And let's also do
real time there as well,
and click on okay. And then once again, before this allowed to actually send
the logs, we need to
authorize that over at the 40 analyzer. So click on accept there, and then we
'll go to the 40 analyzer
and say, Hey, you know, these two firewalls firewall two and firewall three,
they both would like to
log to is that okay? And once the 40 analyzer says yes, then firewall two and WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
log to is that okay? And once the 40 analyzer says yes, then firewall two and
firewall three can
start forwarding their logs. So back to the 40 analyzer, we go and here under
device manager,
you'll notice we have two firewalls that are authorized logging devices. And
then we have couple
here that are unauthorized. So if we click on that, it's going to show us those
two firewalls.
That's firewall two and firewall three. So we just click on both of them to
select them,
and then click on authorize. And it's asking us to confirm also right here, if
we had set up
multiple administrative domains, we could actually associate these firewalls
with a specific WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
with a specific
administrative domain. So I'm going to put these in the root domain effectively
, we're not using
multiple adams yet, and we'll click on okay, so it's doing the device
authorization, and that may
take a moment or two. So we'll click on close, it's now starting to up and two
down. But here in a
moment firewall two and firewall three should show up as well. So we'll give
that a moment to go
ahead and settle. Meanwhile, let's go take a look at firewall two and firewall
three. So here's
firewall two, it still says unauthorized. So let's go ahead and refresh this
page by just bouncing
off and coming back to it. And the 40 analyzer hasn't finished its work yet. So WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
off and coming back to it. And the 40 analyzer hasn't finished its work yet. So
let's also verify
on firewall three. And there we go firewall three doesn't show a problem, which
is 40 analyzer
connected fantastic. Let's go back to firewall two. So back at firewall two,
sure enough, we are
now showing connected there. And if we go back to the 40 analyzer and do a
refresh there, it shows
three up one down. But I imagine here for way just a moment or two, it should
show us that we have
four out of four up. So let me go ahead and click on device manager again. And
sure enough, we have
four out of four up and reporting. So all the logs now from these four 48 firew WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
four out of four up and reporting. So all the logs now from these four 48 firew
alls are being sent
over to 40 analyzer. So as the test here's what I propose we do, let's go to PC
two. And let's go
ahead and forward some traffic out to the internet. And that information
regarding PC two should be
sent over to 40 analyzer. Also be aware that at the moment firewall two
firewall three and firewall
one are not part of the same security fabric. So until we have that set up, we
may have some
duplicate logs as well. So let's go to PC two and send some traffic out to the
internet. So here is WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
internet. So here is
PC two, let me go ahead and open up a browser. And on one of the two firewalls,
and it's going to be
either firewall two or firewall one, they're requiring authentication. So open
the network login page,
then we'll log on is ad dash user dash two, I'll put in the password for that
user, and then we'll
click on continue. Fantastic. And let's go to for net.com. So I'll close that
browser. So that
traffic should be logged here on firewall two and also here at firewall one, as
that client's traffic
is going out to the internet. And because firewall two and firewall one are WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
is going out to the internet. And because firewall two and firewall one are
both reporting to 40 analyzer,
we should be able to see both of those logs right here at the 40 analyzer
regarding PC two's traffic.
In fact, let's generate some traffic that'll be really easy to identify. So let
's go to YouTube,
and that way it'll be easier to pick it out of the crowd. All right, so we're
going to YouTube,
fantastic. I'll close that. I'll minimize that browser. And let's go back to
the 40 analyzer
and take a look at the logs. So back at 40 analyzer, we're going to talk a lot
about the
different options here to look at the details and logs. But if we go to log WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
different options here to look at the details and logs. But if we go to log
view, and then we go to
40 gate, we can look at the individual 40 gate firewalls at their logs. And
what's really happening
is we're not reaching out and looking at the logs at those 40 gates, those 40
gates have already
sent that log information over to the 40 analyzer. So currently I have traffic
selected,
looking at the traffic logs. So here in the traffic logs, if we want to sort
out based on
40 firewall, I can say instead of looking at all devices, let's take a look at
firewall two,
and we'll click on okay. And this is just going to show us the logs that were
sent over from
firewall two, which is our Linux client right here. So if we click on that, it WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
firewall two, which is our Linux client right here. So if we click on that, it
's 10, 20,
0, 1, 0, 2, let me just confirm that's the IP address on our Linux device,
which is PC two. So
we'll bring up a command prompt here, and do an IF config. And sure enough, 10
dot 20 dot 0 dot 1,
0, 2. Then if we go back up here and say, you know, instead of just firewall
two, let's go ahead and
change that just to firewall one and click on okay. Once again, we should be
able to
see information from firewall one's perspective about the traffic. So if we
scroll down and go to
page two, there we go. There's 80 user two. So the failed connection is very WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
page two, there we go. There's 80 user two. So the failed connection is very
likely before we
authenticated. So I could right click here and then add a filter. And then this
is firewall one
reporting on all the logs where the traffic was sourced from 80 user two at
that IP address 10
dot 20 dot 0 dot 1, 0, 2. And the quick traffic would be related to the way
that YouTube is forwarding
the streams of data down to the client. Now it's also interesting to note that
firewall one has
associated this IP address with 80 user two. But if we go back, if we clear the
filters by clicking on
the X here, if we go back to firewall two only and click on okay, there's our WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
the X here, if we go back to firewall two only and click on okay, there's our
Linux client. But from
the perspective of firewall two, here we have the Linux client again, but it
doesn't say that it's
80 dash user two. And that very likely is because of this firewall one has some
policies in place
requiring authentication identifying who the user is while firewall two doesn't
. And as a result,
that's why the reports coming from firewall one included the ID and the reports
coming from firewall
two didn't. And this will all be more cohesive if if we had a 40 gate security
fabric where, for WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
fabric where, for
example, firewall one was the route. And then firewall two and firewall three
were members of the security
fabric. In fact, in the next video, let's do exactly that and tell these three
firewalls that
they are part of the same security fabric. And then we can compare and contrast
that with the 40
analyzer logs that are coming in. So I'll see you in the next video for exactly
that.