Accenture MDR Quick Start Guide for F5 Silverline

This quick start guide will help Accenture MDR customers configure F5 Silverline to send logs to the Log collection Platform (LCP).

This document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

Port Requirements

Table 1-1: Port requirements for LCP communication.

Configuring F5 Silverline

Pre-Requisition: 

1. Log Export logs will be sent from each Point of Presence (mPop/rPoP) that a proxy is deployed in. To ensure you receive all log messages you must allow a specific list of F5 Silverline SNAT IPs to your firewall allow-list. Failure to do so may result in some, or all, log messages being undelivered.

2. Log Export is NOT enabled by default, you need to connect to Silverline SOC for that.

Device Configuration

1. Login to the F5 Silverline Customer Portal.

2. Navigate to Config > Log Export in the Portal

3. On the Log Export page, click Create Endpoint that corresponds to your log server

4. On the Add Log Export Destination page:
   a. Check the Event Types you wish to receive log data, select ALL
   b. From the Format drop-down box to the right of each event that you selected, choose the log format that the log data that should be sent in, select RFC-3164.
   c. In Destination Host enter the Middleware server address for your log receiver
   d. In Destination Port enter the TCP port 6514 for your log receiver.(Port number is completely depends on the customer as they need this configuration to send logs to middleware server)

1. Click Save and your configuration will be queued for global deployment

Note- Configure agents like Nxlog in middleware server to forward logs to LCP.

LCP Configuration Parameters

Table 1-2: The F5 Silverline event collector (Syslog -4009) properties to be configured by Accenture are given in the table.