Syslog rule help required

2020

OK, it's probably simple and i'm missing the obvious but i'm tearing my hair out trying to get a Syslog rule to work!

An example of one of the messages sent by our firewall is :

quote:date=2005-06-06 time=09:25:14 device_id=FGT0000000000000 log_id=0023013001 type=traffic subtype=violation pri=notice vd=root SN=85289080 duration=0 policyid=184 proto=17 service=137/udp status=deny src=10.98.4.20 srcname=10.98.4.20 dst=10.25.10.15 dstname=10.25.10.15 src_int=port3 dst_int=internal sent=0 rcvd=0 src_port=137 dst_port=137 vpn=n/a tran_ip=0.0.0.0 tran_port=0

The rule i'm trying to implement is drop all traffic from source 10.22. with dest port 137.

I've created a rule to drop all messages that match*src=10.22*.*dst_port=137*.

Basically, our Orion site still shows these messages which suggests they're not being dropped.
If i use the Syslog viewer on the box and search for messages using the above criteria, it returns just these messages which would suggest my syntax to match this message is correct.


Any help appreciated.

Isaac

Hi 2020,

First off this sounds as if it is a firewall support question rather than an Orion support question. That means you are breaking the sanctity of the forum and will be punished by the SW gods.

Now on to your question. Without knowing what type of firewall you are running it is fairly difficult to quess at a solution that will prevent traffic from 10.22.0.0 /16 to destination port 137. If you could provide that detail I am certain someone will be able to give you a hand.

Be fantastic.