Security Operations, Logging and Troubleshooting
Logs and time
USG produces traffic, threat, operation and system logs. Syslog severity runs from 0 (emergency) to 7 (debug): a lower number means higher severity. Send logs to eLog or a syslog server, and configure NTP so timestamps correlate across devices. SNMP traps cover health; session and policy counters cover behavior.
Troubleshooting flow
- Physical and link: interface status, ARP.
- Routing:
display ip routing-table, and check the return path. - Zones and policy:
display security-policy, hit counts, Local-zone rules. - NAT:
display nat server,display nat policy. - Session:
display firewall session table, asking whether the flow is created and in which direction. - Application layer: ASPF/ALG, IPS and anti-virus profiles, SSL decryption.
- Packets: capture with
capture-packeton both interfaces.
Worked example
Users cannot reach a new web server in the DMZ. Reasoning: check the interface and route first, then confirm the Untrust to DMZ policy has the correct service and destination. If NAT Server is used, remember the policy matches the private address. If a session appears but no reply arrives, suspect the server default gateway or a missing return route. If FTP control works but data does not, suspect ASPF/ALG.
Traps that cost marks
- Reading syslog severity backwards.
- Editing a policy and testing an existing session instead of a new one.
- Forgetting that management traffic needs a Local-zone policy.
- Blaming the firewall when the server gateway points elsewhere.
- Ignoring clock skew when correlating logs from several devices.