SBG6580 (v8.5.x): Firewall Remote Log Setup

The SBG6580 Gateway has the ability to send firewall attack reports out to a standard Syslog server, so that many instances can be logged over a period of time.  There are four type of logs as followed:

• Permitted Connections - Allows the server to e-mail logs of who is connecting to the network.
• Blocked Connections - Allows the server to e-mail logs of who is blocked from connecting to the network.
• Known Internet Attacks - Allows the server to e-mail logs of known Internet attacks against the network.
• Product Configurations Event - Allows the server to e-mail logs of the basic product configuration event logs.

The Firewall Remote Log is not enabled by default.  This document describes how to enable and configure the Firewall Remote Log.

NOTE 1: The Syslog server must be on the same network on the LAN (Local Area Network) behind the Gateway (typically 192.168.0.x).

NOTE 2: The Syslog server must be configured and running to receive log entries from the SBG6580 Gateway.  Please refer to the manufacturer's documentation for assistance.

To Enable Remote Log

1. Launch a web browser, such as Internet Explorer, Firefox, or Safari.  Enter http://192.168.0.1 into the address box, and press the Enter key.  The Login page appears.
   
   NOTE: By default the LAN IP address is 192.168.0.1.  If the default address has been changed, enter the custom address in the address box.
    
2. On the Login page:
   a.   Enter admin in the Username field.
   b.   Enter motorola in the Password field.
   c.   Click the Login button.  The Home page appears.
   
   NOTE: On firmware version 8.9.0.4 and later, the default admin password is required to be changed.  The Change User Password prompt will immediately appear after logging into the Web manager with the default admin password.  For assistance with the Change User Password screen, please refer to article # 18055 - SBG6580 (v.8.9.x): Prompt to Change Default Admin Login.
    
   
    
3. Move the mouse-cursor over the Firewall tab and select the Remote - Log sub-link.  The Firewall - Remote Log page appears.
4. On the Firewall - Remote Log page:
   a.   Permitted Connections - Check the box to select the log.
   b.   Blocked Connections - Check the box to select the log.
   c.   Known Internet Attacks  - Check the box to select the log.
   d.   Product Configurations Event - Check the box to select the log.
   
   NOTE: Normally the IP address of the Syslog server should be hard-coded so that the address does not change and always agrees with the entry on this page.
   
   e.   to Syslog server at 192.168.0. -  Enter the last digit of the Syslog server's IP address.
   f.   Click the Apply button to save settings.