Page 66 / 234 Scroll up to view Page 61 - 65
Model FVL328 ProSafe High-Speed VPN Firewall Reference Manual Revision 2
5-16
Protecting Your Network
May 2004, 202-10030-02
Send alerts and logs by e-mail.
If you enable e-mail notification, these boxes cannot be
blank.
Enter the e-mail address to which logs and alerts will be sent. This e-mail address will also
be used as the From address. If you leave this box blank, log and alert messages will not
be sent via e-mail.
If you wish to set the From E-mail address used by this mail, or your SMTP server
requires you to login before you can send mail, click the
Advanced
button and
configure the Advanced E-mail screen.
Figure 5-11:
Advanced E-mail
Check “My Mail Server requires authentication” if you need to log in to your SMTP
server in order to send e-mail. If this is checked, you must enter the login name and
password for your mail server.
Enter the name or IP address of your ISP’s outgoing (SMTP) mail server (such as
mail.myISP.com). You may be able to find this information in the configuration menu of
your e-mail program.
Tip
: You used this information when you set up your e-mail program. If you cannot
remember it, check the settings in your e-mail program.
Send E-mail alerts immediately.
You can specify that logs are immediately sent to the
specified e-mail address when any of the following events occur:
If a Denial of Service attack is detected.
If a Port Scan is detected.
Page 67 / 234
Model FVL328 ProSafe High-Speed VPN Firewall Reference Manual Revision 2
Protecting Your Network
5-17
May 2004, 202-10030-02
If a user on your LAN attempts to access a Web site that you blocked using Keyword
blocking.
Send logs according to this schedule.
You can specify that logs are sent to you according to a
schedule. Select whether you would like to receive the logs Hourly, Daily, Weekly, When Full,
or None for no logs. Depending on your selection, you may also need to specify:
Day for sending log
Relevant when the log is sent weekly or daily.
Time for sending log
Relevant when the log is sent daily or weekly.
If the Weekly, Daily or Hourly option is selected and the log fills up before the specified
period, the log is automatically e-mailed to the specified e-mail address. After the log is sent,
the log is cleared from the router’s memory. If the router cannot e-mail the log file, the log
buffer may fill up. In this case, the router overwrites the log and discards its contents.
Be sure to click Apply when you have finished configuring this menu.
Viewing Logs of Web Access or Attempted Web Access
The router will log security-related events, such as denied incoming and outgoing service requests,
hacker probes, and administrator logins. If you enable content filtering in the Block Sites menu,
the Log page will also show you when someone on your network tries to access a blocked site. If
you enabled e-mail notification, you will receive these logs in an e-mail message. If you do not
have e-mail notification enabled, you can view the logs here.
Page 68 / 234
Model FVL328 ProSafe High-Speed VPN Firewall Reference Manual Revision 2
5-18
Protecting Your Network
May 2004, 202-10030-02
Figure 5-12:
Logs menu
See
Appendix D, “Firewall Log Formats
” for a full explanation of log entry formats.
Log action buttons are described in
Table 5-1
Page 69 / 234
Model FVL328 ProSafe High-Speed VPN Firewall Reference Manual Revision 2
Protecting Your Network
5-19
May 2004, 202-10030-02
.
What to Include in the Event Log
Use these checkboxes to determine which events are included in the log. Checking all options will
increase the size of the log, so it is good practice to disable any events which are not really
required.
All Web sites and news groups visited - If checked, all visited Web sites and newsgroups are
logged.
All Incoming TCP/UDP/ICMP traffic - If checked, all incoming TCP/UDP/ICMP connections
and traffic is logged.
All Outgoing TCP/UDP/ICMP traffic - If checked, all outgoing TCP/UDP/ICMP connections
and traffic is logged.
Other IP traffic - If checked, all other traffic (IP packets which are not TCP, UDP, or ICMP) is
logged.
Router operation (start up, get time, etc.) - If checked, Router operations, such as starting up
and getting the time from the Internet Time Server, are logged.
Connection to the Web-based interface of this Router - If checked, Administrator connections
to the Web-based interface will be logged.
Other connections and traffic to this Router - If checked, this will log traffic sent to this Router
(rather than through this Router to the Internet).
Allow duplicate log entries - If checked, then events or packets which fall within more than
one (1) category above will have a log entry for each category in which they belong. This will
generate a large number of log entries. If unchecked, then events or packets will only be
logged once. Usually, this should be left unchecked.
Logging programs are available for Windows, Macintosh, and Linux computers.
Enable one of these three options, as required:
Table 5-1.
Log action buttons
Field
Description
Refresh
Refreshes the log screen.
Clear Log
Clears the log entries.
Send Log
E-mails the log immediately.
Page 70 / 234
Model FVL328 ProSafe High-Speed VPN Firewall Reference Manual Revision 2
5-20
Protecting Your Network
May 2004, 202-10030-02
Disable - select this if you do not have a Syslog server.
Broadcast on LAN - the Syslog data is broadcast, rather than sent to a specific Syslog server.
Use this if your Syslog Server does not have a fixed IP address.
Send to this Syslog server IP address - If your Syslog server has a fixed IP address, select this
option, and enter the IP address of your Syslog server.

Rate

4 / 5 based on 1 vote.

Bookmark Our Site

Press Ctrl + D to add this site to your favorites!

Share
Top