Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 
 

Configuring Netgate pfSense to Communicate with JSA

To send syslog messages to JSA, the Netgate pfSense remote logging options must be configured to specify a remote log server.

If you want to send Snort IDS events to JSA, ensure that the Snort package for Netgate pfSense is installed and configured. Snort is an open source network intrusion detection and prevention system.

  1. Log in to Netgate pfSense device.
  2. Configure remote logging options for Netgate pfSense.

    1. Select Status > System Logs.

    2. Click the Settings tab and then go to the Remote Logging Options section.

    3. Select a Source Address, or use the default.

    4. Select an IP Protocol or use the default.

    5. In the Remote log servers options section, enable System Events, Firewall Events, DNS Events, and DHCP Events.

    Note:

    If the System Events logging option is enabled, Unknown or Stored events might occur because extra services that are installed by packages for Netgate pfSense can output log messages to the system log. Due to the large number of packages available for Netgate pfSense, the DSM was developed to support the base installation of the device. The DSM Editor can be used in this case to create custom parsing for any Unknown or Stored events that result from user installed packages. For more information about the DSM Editor, see the Juniper Secure Analytics Administration Guide.

    Note:

    If DHCP events are enabled, you must create a Linux DHCP log source in JSA to normalize the DHCP events. The Linux DHCP log source must be placed after Netgate pfSense log source in the parsing order.

    Note:

    If you send Snort or Suricata events to JSA and the log source is not automatically detected, add a Snort log source on the JSA Console For more information, see Syslog Log Source Parameters for Open Source SNORT.

  3. Optional: Configure the Snort service to output logs to the Netgate pfSense system log.

    1. Select Service > Snort.

    2. On the Snort Interface tab, click Edit this Snort interface mapping (pencil icon).

    3. In the Alert Settings section, enable Send Alerts to System Log.

    4. Click Save.

    5. On the Snort Interface tab, click Restart Snort on this interface.