Accenture MDR Quick Start Guide for Juniper Networks® NetScreen Firewall

This quick start guide will help Accenture MDR customers configure Juniper Networks® NetScreen Firewall to send logs to the Log Collection Platform (LCP).

The guide details the GUI configuration process. Please refer to the vendor document for more information on the CLI configuration process.

This document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found at

Accenture Portal - https://mss.accenture.com/PortalNextGen/Reports/Documents

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring Juniper Networks NetScreen Firewall

To enable syslog for Juniper NetScreen Firewall, follow the steps given below.

1. Login to the NetScreen web interface.

2. In the left pane, go to Configuration > Report Settings > Log Settings.

3. In the central pane, check all the Event Severity check boxes and then click Apply.

4. In the left pane, go to Configuration > Report Settings > Syslog.

5. Check the Enable Syslog Messages check box.

6. In the Source interface drop-down list, choose the NetScreen interface from which the syslog packets need to be sent.

7. In the Syslog Servers section, check the Enable check box and type the following parameters:

   1. In the IP/Hostname text box, type the LCP IP address.

   2. In the Port text box, type 514.

   3. In the MDR Facility drop-down list, choose a MDR facility level. The default value is Local0.

   4. In the Facility drop-down list, choose a facility level. The default value is Local0.

8. Click Apply.

 Note: Both Accept and Deny logs play an important part in the analysis of traffic seen at the firewall. To receive the maximum benefit from a firewall logging to MDR, all rules that make up the installed firewall policy including an Explicit Deny All (also known as Clean-Up) rule should be configured to log.

LCP Configuration Parameters

Table 1-2: The Juniper NetScreen event collector(Syslog-3064)properties to be configured by MDR are shown in the table.