Ivanti Pulse Connect Secure (Pulse Secure VPN)

About the Device

The New Pulse Secure Access Service enable you to give employees, partners, and customers secure and controlled access to your corporate data and applications including file servers, Web servers, native messaging and e-mail clients, hosted servers, and more from outside your trusted network using just a Web browser.

Pulse Connect Secure authorizes the resources that are accessed by users through an extranet session hosted by the appliance. Pulse Connect Secure intermediates the data that flows between external users and the company's internal resources to provide robust security. The following diagram is an example of Pulse Connect Secure within a LAN environment.

Device Information

Collection Method

Port Requirements

To facilitate secure communication and align with our best practice, we strongly encourage the use of Transport Layer Security (TLS) between your security devices and our Adaptive MxDR platform for event forwarding.

While we understand that TLS support may not be available on all devices, if your devices do support TLS communication, we recommend utilizing port 6514 for seamless integration.

In some cases, the upgraded version of the device might incorporate TLS support without prior notice. If you come across such a scenario or for further assistance in configuring TLS, we kindly ask you to reach out to your dedicated Adaptive MxDR Service Delivery Lead.

Device Configuration

Pulse secure needs to be configured for forwarding syslog events to the collector. Steps to enable the syslog setting on the device are given below:

To enable syslog logging on Pulse Secure VPN 

1. Start the Pulse connect secure console.

2. Click System > Log/Monitoring > Events > Log Settings

3. In Select Events to Log, select all check boxes.

Open

4. Under Syslog Servers, do the following:

   1. Enter the name or IP address of the CyberHub server.
      Note: Specify the fully qualified domain name or IP address for the syslog server.

   2. Enter a facility for the server.

   3. The IVE provides eight facilities (LOCAL0 through LOCAL7).
      You can use these settings to map facilities on your syslog server.

   4. Under Type Select TLS.
      Note: If you select TLS from the Type list, the server name must match the CN in the subjectDN in the certificate obtained from the server.

   5. Under Client Certificate provide the Certificate.
      Note: If you select TLS from the Type menu and your remote syslog server requires client certificates, select the installed client certificate to use to authenticate to the syslog server. Client certificates are defined in the Configuration > Certificates > Client Auth Certificates. Client certificates must be installed on the device before they can be used.

   6. Under Filter Select Standard (default).

   7. Source Interface. If TLS is selected in Step d then use port 6514.

5. Click Add.

6. Repeat Steps 3 through 5 to add multiple servers (for Events, Admin Access or User Access Logs)

7. Click Save Changes.

To confirm that the Standard log format is set as the default 

1. Start the Pulse connect secure console.

2. Click System > Log Monitoring > Events tab, and then choose Filters.

Open

3. Select the filter that is named Standard.

4. If the Standard filter is not defined as the default, select Make Default.

5. In Export Format, click Standard Format and check if the format is Matching with the Format of Screenshot.

6. Repeat the above steps for User and Admin Access and check the Format.
   
   

Integration Parameters

Parameters required from customer for Integration.