Accenture MDR Quick Start Guide for ForcePoint Next Generation Firewall (Stonesoft StoneGate™)

This quick start guide will help Accenture MDR customers configure ForcePoint Next Generation Firewall (NGFW) to send logs to the Log Collection Platform (LCP).

The document includes the following topics:

1 Supported Versions
2 Port Requirements
3 Configuring ForcePoint NGFW
4 LCP Configuration Parameters

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Source

Destination

Port

Description

ForcePoint NGFW

(Stonesoft StoneGate)

LCP

514 (UDP) or

601 (TCP)

Default port

Configuring ForcePoint NGFW

Based on the StoneGate appliance or ForcePoint NGFW version used, you can configure it in two ways.

StoneGate or ForcePoint NGFW appliance or version 5.5 or lower.
StoneGate or ForcePoint NGFW appliance upto version 5.5 or higher

Configuring StoneGate appliance or ForcePoint NGFW appliance version 5.5 or lower

To configure the StoneGate appliance or ForcePoint NGFW appliance, follow the steps below.

To stop the Log server,

Note: If you have defined the Log server as a service in Windows, you may stop the Log server in the Windows Services list.

StoneGate

a) For Windows, go to Start > Run and enter the command: <installation directory>/bin/sgStopLogSrv.bat

b) In Linux CLI prompt, enter the command: <installation directory>/bin/sgStopLogSrv.sh

Forcepoint

c) For Windows , go to Start > Services.msc > Forcepoint NGFW Log server services > Stop.

2. Modify the LogServerConfiguration.txt file which is located in <installation directory>/data/ using the following configurations:

SYSLOG_EXPORT_ALERT = YES
SYSLOG_EXPORT_FORMAT = XML
SYSLOG_PORT= 514
SYSLOG_SERVER_ADDRESS = <LCP_IP_Address>
For Firewall

SYSLOG_EXPORT_FW = YES

For IPS

SYSLOG_EXPORT_IPS = YES

3. Save the file and restart the Log server.

Note: Table 1-2 provides additional information on the Log server configuration parameters:

Parameter	Values and Meaning
SYSLOG_CONF_FILE	<File name> Defines the configuration file for syslog export. The file contains a list of the fields that are exported to syslog. The <installation directory>/data/fields/syslog_templates/ directory contains example configuration files. If you also want the exported logs to contain the reference IDs of known vulnerabilities, add the VULNERABILITY_REFERENCES field to the configuration file.
SYSLOG_EXPORT_ALERT	Defines whether to export alert entries to syslog. Possible values are as follows: YES NO
SYSLOG_EXPORT_FORMAT	Defines the file format used for syslog exporting. Possible values are as follows: CSV XML
SYSLOG_EXPORT_FW	Defines whether to export StoneGate Firewall/VPN logs to syslog. Possible values are as follows: YES NO
SYSLOG_EXPORT_IPS	Defines whether to export IPS logs to syslog. Possible values are as follows: YES NO
SYSLOG_FILTER_MATCH	ALL Note: The log is exported if it matches all filters. ONE Note: The log is exported if it matches at least one filter. NONE Note: The log is exported if it does not match any of the filters.
SYSLOG_FILTER_TYPE	KEEP Note: The matching logs are sent to the syslog server. DISCARD Note: The matching logs are not sent to the syslog server.
SYSLOG_MESSAGE_PRIORITY	The priority of the syslog message is included at the beginning of each UDP packet (the default is 6). 0-191 Note: As defined in RFC 3164 (http://www.ietf.org/rfc/rfc3164.txt).
SYSLOG_PORT	The default port is 514 (UDP).
SYSLOG_SERVER_ADDRESS	The IP address of the LCP.

Configuring StoneGate appliance or ForcePoint NGFW appliance version 5.5 or higher.

To configure the StoneGate appliance or ForcePoint NGFW appliance, follow the steps below.

Login to the SMC console.
Go to Home > Others.
Right-click the Log Server, and select Properties.

4. Switch to the Log Forwarding tab.

For Firewall:

DataType = FW
Format = XML
Port = 514

For IPS:

DataType = Inspection
Format = XML
Port = 514

Note: The Collector supports only XML format for Firewall and IPS.

Table 1-3: The Log server properties and their description.

Property	Value	Explanation
Target Host		The Host element that represents the target host to which log data is forwarded.
Service	TCP UDP	The network protocol to forward log data. Note: If you have to define an access rule that allows traffic to the target host, make sure that the service you select is also used as the service in the access rule
Port	514	The port that is used for log forwarding. Note: If you have to define an access rule that allows traffic to the target host, make sure that the port you select is also used as the port in the access rule.
Format	CEF	Logs are forwarded in CEF format.
	CSV	Logs are forwarded in CSV format.
	LEEF	Logs are forwarded in LEEF format.
	NetFlow	Logs are forwarded in NetFlow format. The supported version is NetFlow v9.
	IPFIX	Logs are forwarded in IPFIX (NetFlow v10) format.
	XML	XML
Data Type		The type of log data that is forwarded.
Filter (Optional)		An optional local filter that defines which log data is forwarded. The local filter is only applied to the log data that matches the log forwarding rule.

To Populate Packet Fields for IPS v5.5.x

Add the following fields in the < Installation Directory>:\ForcePoint\Management Center\dataStonegate\fields\datatypes\ips_log_datatype.xml file.

<fieldref>ACC_RX_BYTES</fieldref>

<fieldref>ACC_TX_BYTES</fieldref>

<fieldref>ACC_RX_PACKETS</fieldref>

<fieldref>ACC_TX_PACKETS</fieldref>

<fieldref>EXCERPT</fieldref>

<fieldref>RECORD_ID</fieldref>

<fieldref>EXCERPT_POS</fieldref>

Add the following fields in the <Installation Directory>:\ForcePoint\Management Center\dataStonegate\fields\syslog_templates\default_syslog_conf.xml file.

<fieldref>ACC_TX_PACKETS</fieldref>

<fieldref>ACC_RX_PACKETS</fieldref>

<fieldref>RECORD_ID</fieldref>

<fieldref>EXCERPT</fieldref>

Save the file and restart the Log server.

Note: Accenture MDR recommends not to use the Alert level of logging as Alert logs because it reduces the quality of logs. Accenture MDR provides support to retention of logs only, if Alert logging is used.

LCP Configuration Parameters

Table 1-4: ForcePoint NGFW event collector (Syslog – 3134) properties to be configured by MDR are shown in the table.

Property	Default Value	Description
Protocol	UDP	The default protocol for syslog. The collector can also accept logs in TCP. Note: While TCP offers guaranteed delivery of log packets, it places a larger overhead on the LCP. To balance TCP for reliability over UDP for speed/simplicity, contact the Accenture MDR onboarding team.
IP Address	ForcePoint NGFW interface IP address	Logging device IP address mentioned in the Pre-Installation Questionnaire (PIQ). Note: If the device sends logs using multiple interfaces, contact the Accenture MDR onboarding team.
Port Number	514	The default port number for syslog. For TCP, the default port is 601. Note: The LCP can be configured to listen on a non-standard port, please advise the Accenture MDR onboarding team if this is a requirement.