For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

ESSZak's avatar
ESSZak
Icon for Nimbostratus rankNimbostratus
May 01, 2019

ASM logs to Splunk

hi everybody , i configured looging profile to send asm logs to splunk , but loggs is send from self ip address , Can i send logs from managment IP & and what's better ??  
ASM Advanced WAF
security
youssef1's avatar
youssef1
Icon for Cumulonimbus rankCumulonimbus
May 01, 2019

Hi,

Yes you can send using mgmt interface:

you just need to set route using cli:

tmsh create /sys management-route  network / gateway

  • destination network/ your syslog IP 1.1.1.1/255.255.255.255
  • server-syslog-1
  • will be the GW of your mgmt IP

you have to add as much route as syslog server server

once done save config

tmsh save /sys config

then check route:

tmsh list /sys management-route

you can send syslog logs through the interface that suits you (mgmt or business). if you have a license limitation (badwitch). it is indeed more advantageous to send it through the managemet interface because the restriction does not impact the mgmt interface...

keep me in touch if you need more details

regards