Watchguard reporting

Apr 07, 2006 2 Replies
J

I'm sure this is an often asked question, but I can't seem to find the right words to search with, because I can't find my answer.



I have several Watchguard X500 & X700 firewalls at client sites. Part of the selling pitch from WG is their reporting. Well, I can print some great looking bar graphs, but it's waaaay too much information.



I now have clients asking me to report on where "user X" has been browsing to. I've tinkered with this thing for weeks now, and can't seem to get the massive amount of data down to a managable size. As usual, the Watchguard support site is useless (unless your an enduser who's never touched a firewall before).



Anyone have any luck reporting on the WG's? Specifically, I need to be able to look at all pc's in a certain subnet (I'm thinking it's going to force me to host, but even that doesn't work right).



HELP!?!?!



thanks for your time,



jf



Vote
Twitter Facebook LinkedIn
L

The logs report what you tell them to report and they show the type of traffic, direction, IP or Authenticated user, etc...

If you export the logs to Excel then write a couple filter/sort scripts, you can import them daily and give reports like you need.

If you want to report what user is doing what, as opposed to what IP is doing what, you need to setup the FB so that it can see the active directory - so that it can tell a user from an IP.

As an example, you can search for ALLOW and HTTP in the export to find all permitted HTTP outbound connections - as long as your rule is named HTTP.

Vote
Twitter Facebook LinkedIn
A

Can you send us - snipped-for-privacy@firegen.com - some logs from your Watchguard firewalls? We can add support for it in our FireGen NG Log analyzer (see

formatting link
and as a beta tester you might get a significant discount and the customizations that you require
formatting link
The "Forensics" feature seems to match the requirement you mentioned in your email.

Regards, Adrian Grigorof Altair Technologies

formatting link

Vote
Twitter Facebook LinkedIn

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required