|
| 1 | +# Agent Integration: cloudgen_firewall |
| 2 | + |
| 3 | +## Overview |
| 4 | + |
| 5 | +Barracuda CloudGen Firewall is a next-generation firewall (NGFW) family from Barracuda Networks designed to protect and optimize modern, distributed networks whether on-premises, in the cloud, or across hybrid environments. This integration monitors [cloudgen_firewall][1]. |
| 6 | + |
| 7 | +## Setup |
| 8 | +1. Collecting logs is disabled by default in the Datadog Agent. Enable it in the `datadog.yaml` file with: |
| 9 | + |
| 10 | + ```yaml |
| 11 | + logs_enabled: true |
| 12 | + ``` |
| 13 | +
|
| 14 | +2. Add this configuration block to your `cloudgen_firewall.d/conf.yaml` file to start collecting your cloudgen_firewall logs: |
| 15 | + |
| 16 | + ```yaml |
| 17 | + logs: |
| 18 | + - type: file |
| 19 | + path: /var/log/cloudgen_firewall.log |
| 20 | + source: cloudgen_firewall |
| 21 | + service: <SERVICE_NAME> |
| 22 | + ``` |
| 23 | + |
| 24 | + Change the `path` and `service` parameter values for your environment. |
| 25 | + |
| 26 | +3. [Restart the Agent][4]. |
| 27 | + |
| 28 | +### Installation |
| 29 | + |
| 30 | +The cloudgen_firewall check is included in the [Datadog Agent][2] package. |
| 31 | + |
| 32 | +### Prerequisites |
| 33 | + |
| 34 | +1. Administrative access to Barracuda CloudGen Firewall installed on your server. |
| 35 | +2. The Datadog Agent installed and running (on a server or container that can receive syslog messages). |
| 36 | +3. Network Access between the firewall and the Datadog Agent (usually port 514, but may be a custom value). |
| 37 | +4. Syslog support enabled in the Datadog Agent (with a TCP or UDP listener configured). |
| 38 | + |
| 39 | +### Validation |
| 40 | + |
| 41 | +1. Confirm the Datadog Agent is listening on the correct port (`514` in the following examples): |
| 42 | + |
| 43 | + `sudo netstat -tunlp | grep 514` |
| 44 | + |
| 45 | + If using TCP and UDP listeners, use the following command: |
| 46 | + |
| 47 | + `sudo lsof -i :514` |
| 48 | + |
| 49 | +2. Confirm logs are reaching the Agent from the correct log source: |
| 50 | + |
| 51 | + `tail -f /var/log/datadog/syslog.log` |
| 52 | + |
| 53 | + **Note**: If the file doesn't exist, verify that syslog logs are being written by your configuration. |
| 54 | + |
| 55 | +3. Use the tcpdump command to confirm network traffic on the Datadog Agent host: |
| 56 | + |
| 57 | + `sudo tcpdump -i any port 514` |
| 58 | + |
| 59 | +After running this command, you should see traffic from the CloudGen Firewall IP address. If you don't see any such traffic, check the firewall rules between CloudGen and the Datadog Agent. Confirm the correct protocol (UDP or TCP) is being used on both sides. |
| 60 | +4. Check the Datadog [Live Tail][7] for logs from the source and service you defined in the `conf.yaml` file. |
| 61 | +5. After following these steps, you can create a test log on the firewall by triggering an event. |
| 62 | +6. Check for tags or facets to use for better filtering based on the required data. |
| 63 | + |
| 64 | +## Data collected |
| 65 | + |
| 66 | +### Metrics |
| 67 | + |
| 68 | +The Barracuda CloudGen Firewall integration does not include any metrics. |
| 69 | + |
| 70 | +### Logs |
| 71 | + |
| 72 | +The Barracuda CloudGen Firewall logs contain key information such as the event timestamp, source and destination IPs and ports, protocol used, firewall action (allow or deny), the matched rule name, user identity (if available), log type (such as firewall, VPN, authentication), network interface, device name, status of the operation, and many more. This helps you to monitor traffic behavior, access control, and system activity. |
| 73 | + |
| 74 | + |
| 75 | +### Events |
| 76 | + |
| 77 | +The cloudgen_firewall integration does not include any events. |
| 78 | + |
| 79 | +## Troubleshooting |
| 80 | + |
| 81 | +Need help? Contact [Datadog support][3]. |
| 82 | + |
| 83 | +[1]: https://www.barracuda.com/products/network-protection/cloudgen-firewall |
| 84 | +[2]: /account/settings/agent/latest |
| 85 | +[3]: https://docs.datadoghq.com/help/ |
| 86 | +[4]: https://docs.datadoghq.com/agent/guide/agent-commands/#start-stop-and-restart-the-agent |
| 87 | +[5]: /integrations?search=barracuda_cloudgen_firewall |
| 88 | +[6]: https://github.com/DataDog/integrations-core/blob/master/cloudgen_firewall/assets/service_checks.json |
| 89 | +[7]: /logs/livetail |
0 commit comments