Barracuda CloudGen Firewall

About the Device

 The Barracuda CloudGen Firewall is an enterprise-grade, next-generation firewall that was purpose-built for efficient deployment and operation within dispersed, highly dynamic, and security-critical network environments.

Device Information

Collection Method

Port Requirements

To facilitate secure communication and align with our best practice, we strongly encourage the use of Transport Layer Security (TLS) between your security devices and our Adaptive MxDR platform for event forwarding.

While we understand that TLS support may not be available on all devices, if your devices do support TLS communication, we recommend utilizing port 6514 for seamless integration.

In some cases, the upgraded version of the device might incorporate TLS support without prior notice. If you come across such a scenario or for further assistance in configuring TLS, we kindly ask you to reach out to your dedicated Adaptive MxDR Service Delivery Lead.

Device Configuration

To Enable Syslog Streaming

1. Log in to Firewall using Barracuda Firewall Admin

Open

2. Navigate to CONFIGURATION > Configuration Tree > Box > Infrastructure Services > Syslog Streaming.

3. Click Lock.

4. Set Enable the Syslog service to yes.

5. Click Send Changes and Activate.

Open

To Configure Logdata Filters

Define profiles specifying the log file types to be transferred or streamed.

1. Navigate to CONFIGURATION > Configuration Tree > Box > Infrastructure Services > Syslog Streaming.

2. In the left menu, select Logdata Filters.

3. Click Lock.

4. Click the + icon to add a new filter. 

5. Enter a Name and click OK. The Filters window opens.

6. Click + in the Data Selection table and select Firewall_Audit_Log. [We are not supporting logging from Fatal_log and Panic_log]

7. In Affected Box Logdata, Select All from the Data Selector.

8. Click OK.

9. In the Affected Service Logdata, select All from the Data Selector.

10. Click OK.

12. Click Send Changes and Activate.

To Configure the Logstream Destinations

1. Navigate to CONFIGURATION > Configuration Tree > Box > Infrastructure Services > Syslog Streaming.

2. In the left menu, select Logstream Destinations.

3. Click Lock.    

4. Click + in the Destinations table. The Destinations window opens.

5. Configure the Remote server logstream destination:

   1. Logstream Destination – Select Explicit

   2. Destination – CyberHub IP.

   3. Destination Port – Enter 6514 (TLS protocol)

   4. Transmission Mode – Select TCP.

   5. Sender IP – Enter the management IP address of the Barracuda CloudGen Firewall or leave blank.

   6. Use SSL Encapsulation – Select yes to send the syslog stream over an SSL-encrypted connection.

   7. Peer SSL Certificate – Import the SSL certificate configured on the server for this data import.

   8. In Log Data Tagging, select no for Add Range/Cluster Info

   9. Override Node Name – Select no

7. Click OK.

To Configure Logdata Streams

Create a logdata stream configuration combining the previously configured Log Destinations and Log Filters

1. Navigate to CONFIGURATION > Configuration Tree > Box > Infrastructure Services > Syslog Streaming.

2. In the left menu, select   Logdata Streams.

3. Click Lock.

4. Click + in the Streams table.

5. Enter a Name and click OK. The Stream Configuration window opens. 

6. In the Log Destinations, click + and select the Log Destination created in To Configure Logstream Destinations.

7. In the Log Filters, click + and select the Log Filter created in To Configure Logdata Filters.

8. Click OK.

9. Click Send Changes and Activate.

To Configure Audit and Reporting

Configure the settings for log policies.

1. Navigate to your CloudGen Firewall > Infrastructure Services > General Firewall Configuration.

2. In Configuration Mode, click Switch to Advanced View.

3. In left menu, click Audit and Reporting.

4. Click Lock.

5. In section Statistics Policy, set Generate Dashboard Information to yes.

6. In section Statistics Policy, set Generate Monitor Information to yes.

7. In Log Policy:

8. Click Send Changes.

9. Click Activate.

Integration Parameters

Parameters required from customer for Integration.