Ask the Community
Groups
How do I configure syslog remote logging for a Ubiquiti Unifi Security Gateway (USG) - Connect IT Community | Kaseya
<main> <article class="userContent"> <h2 data-id="this-article-will-walk-through-the-steps-required-to-send-syslog-data-from-a-ubiquiti-usg-device-to-the-rocketcyber-firewall-analyzer">This article will walk through the steps required to send Syslog data from a Ubiquiti USG device to the RocketCyber Firewall Analyzer</h2> <h3 data-id="enable-remote-logging">Enable Remote Logging</h3> <p><img src="https://us.v-cdn.net/6032361/uploads/migrated/U7EB8JL19BIL/screen-shot-2020-07-21-at-12-59-23-pm.png" alt="Screen_Shot_2020-07-21_at_12.59.23_PM.png" class="embedImage-img importedEmbed-img"></img></p> <p>1. Log in to the Unifi Network Controller and click on Settings (gear icon) at the bottom of the navigation bar.</p> <p><img src="https://us.v-cdn.net/6032361/uploads/migrated/59RNMO91R2ZV/screen-shot-2020-07-21-at-12-59-05-pm.png" alt="Screen_Shot_2020-07-21_at_12.59.05_PM.png" class="embedImage-img importedEmbed-img"></img></p> <p>2. Click on <strong>Network Settings</strong></p> <p>3. Click On <strong>Advanced</strong></p> <p>4. In the<strong> Remote Logging</strong> Section switch on <strong>Enable Syslog</strong></p> <p>5. In the <strong>Syslog Host</strong> field, enter the IP address of the RocketCyber Syslog Server</p> <p>6. In the <strong>Syslog Port</strong> field, enter the Port for the RocketCyber Syslog Server (default is 514 recommended)</p> <p><img src="https://us.v-cdn.net/6032361/uploads/migrated/CYH31R4JZPWQ/screen-shot-2020-07-21-at-1-05-21-pm.png" alt="Screen_Shot_2020-07-21_at_1.05.21_PM.png" class="embedImage-img importedEmbed-img"></img></p> <p>7. Click <strong>Apply Changes</strong> at the bottom of the screen</p> <h3 data-id="configure-firewall-rule-logging">Configure Firewall Rule Logging</h3> <p>Each firewall rule must be configured to allow logging. </p> <p><img src="https://us.v-cdn.net/6032361/uploads/migrated/N5Z7BD9UA5P3/screen-shot-2020-07-21-at-1-11-41-pm.png" alt="Screen_Shot_2020-07-21_at_1.11.41_PM.png" class="embedImage-img importedEmbed-img"></img></p> <p>8. From the Settings Menu, click on <strong>Internet Security</strong></p> <p>9. Click on <strong>Firewall</strong></p> <p>10. For each rule that you want to log events from click on <strong>Edit</strong></p> <p><img src="https://us.v-cdn.net/6032361/uploads/migrated/OQLFER0JPHQZ/screen-shot-2020-07-21-at-1-13-55-pm.png" alt="Screen_Shot_2020-07-21_at_1.13.55_PM.png" class="embedImage-img importedEmbed-img"></img></p> <p>11. In the edit details dialog click on <strong>Advanced</strong></p> <p><img src="https://us.v-cdn.net/6032361/uploads/migrated/DVTTVSC0N0LM/screen-shot-2020-07-21-at-1-14-56-pm.png" alt="Screen_Shot_2020-07-21_at_1.14.56_PM.png" class="embedImage-img importedEmbed-img"></img></p> <p>12. Switch on <strong>Enable Logging</strong></p> <p><img src="https://us.v-cdn.net/6032361/uploads/migrated/8M4UICHAD1GF/screen-shot-2020-07-21-at-1-15-42-pm.png" alt="Screen_Shot_2020-07-21_at_1.15.42_PM.png" class="embedImage-img importedEmbed-img"></img></p> <p>13. Click <strong>Apply</strong></p> <h3 data-id="configure-default-action-logging">Configure Default Action Logging</h3> <p><img src="https://us.v-cdn.net/6032361/uploads/migrated/F0I9CMRT8AT7/screen-shot-2020-07-21-at-1-18-48-pm.png" alt="Screen_Shot_2020-07-21_at_1.18.48_PM.png" class="embedImage-img importedEmbed-img"></img></p> <p>14. On the Firewall page, scroll down to the <strong>Settings</strong> section and click on <strong>Default Action Logging</strong></p> <p><img src="https://us.v-cdn.net/6032361/uploads/migrated/JNCZYPYGEJOB/screen-shot-2020-07-21-at-1-19-59-pm.png" alt="Screen_Shot_2020-07-21_at_1.19.59_PM.png" class="embedImage-img importedEmbed-img"></img></p> <p>15. Switch on <strong>WAN Rules</strong></p> <p>16. Switch on <strong>LAN Rules</strong></p> <p><img src="https://us.v-cdn.net/6032361/uploads/migrated/9LBO3S22FKI0/screen-shot-2020-07-21-at-1-05-21-pm-1.png" alt="Screen_Shot_2020-07-21_at_1.05.21_PM__1_.png" class="embedImage-img importedEmbed-img"></img></p> <p>17. Click on <strong>Apply Changes</strong></p> <p> </p> <p>The steps for this configuration were verified with Controller Software v5.13.29.</p> </article> </main>