Group Policies - Syslog

[RaphaelL]

Hi ,

I have a blank and I can't find the information or test it at the moment.

Simple setup. Client connected to MS and MX is doing routing + L3 firewall.  Client has a group policy applied with "custom network firewall & traffic shaping rules". Does that mean I'm losing all visibility on flows/urls that would be sent by the MX via Syslog ? 

I don't see any options to toggle on/off syslog on the Group Policy , so I would assume that I will lose visibility since this bypass the L3 firewall of the MX that would have that option.

Thanks !

[alemabrahao]

I'm not sure, but I believe you don't lose visibility of the Syslog.

But you do lose visibility of the global Layer 3 firewall rules, because those rules stop being applied when a Group Policy with custom firewall rules is applied.

You still see client flows, URLs, security events, etc. in the Syslog, but they reflect the Group Policy rules, not the global Layer 3 MX rules.

At least that's how I understand it.

[RWelch]

(comment removed)

[alemabrahao]

Have you tested this yet?

[RaphaelL]

Update.  This is with MX26.1.2

I'm seeing every syslog possible even when a client is bound to a GP with custom L3 firewall rules.

My test scenario.

• GP that blocks Gambling with a content filtering rule : works and logs under urls)
• L3 rule that allows/denies a FQDN/IP : works and logs under firewall with pattern : Group Policy Allow
• Outbound flows are logged under flows

It seems to be working just fine !  Excellent news