WatchGuard Firebox System 4.6 User Guide

Designating Event Processors for a FireboxAdding an Event ProcessorFrom Policy Manager:1 Select Setup => Logging.2 Click Add.3 Enter the IP address to be used by the Event Processor.4 Enter the encryption key that secures the connection between the Firebox and theEvent Processor.The default encryption key is the monitoring passphrase set in the QuickSetup wizard. You mustuse the same log encryption key for both the Firebox and the LiveSecurity Event Processor.5 Click OK.Repeat until all primary and backup Event Processors appear in the LiveSecurity EventProcessors list.Enabling Syslog loggingNote that Syslog logging is not encrypted; therefore, do not set the Syslog server to ahost on the External interface. From Policy Manager:1 Select Setup => Logging.The Logging Setup dialog box appears.2 In the Logging Setup dialog box, click the Syslog tab.3 Enable the Enable Syslog Logging checkbox.4 Enter the IP address of the Syslog server.Editing an Event Processor settingModify an Event Processor entry to change the log encryption key. From PolicyManager:1 Select Setup => Logging.The Logging Setup dialog box appears.2 Click the host name. Click Edit.3 Modify the IP address or log encryption key fields. Click OK.You must use the same log encryption key for both the Firebox and the LiveSecurity EventProcessor. To change the log encryption key on the Event Processor, see “Setting the logencryption key” on page 75.Removing an Event ProcessorRemove an Event Processor when you no longer want to use it for any loggingpurpose. From Policy Manager:1 Select Setup => Logging.The Logging Setup dialog box appears.2 Click the host name. Click Remove.User Guide 71