Monitoring¶
Monitoring, under Security in the device menu, sets what the device sends to servers you run. It has two independent sections, because logs and security events usually belong to different people:
- Log forwarding — the device's own system logs, to your log collector
- Intrusion detection — firewall blocks and attack alerts, to your detection server
The device only reports. Nothing on this page changes what traffic is allowed.
Log forwarding¶
- Tick Forward logs to an external collector.
- Fill in Collector address (a host or IP reachable from the device), Port (514 by default) and Transport: UDP (standard) or TCP (reliable).
- Apply Changes and Confirm.
This is separate from the Logs shown in the portal.
Intrusion detection¶
There are two kinds of event, with very different costs:
- Firewall blocks (no cost) — everything the device refuses. Needs no extra software and no extra memory, and works on every gateway.
- Attack alerts (needs memory) — installs a detection engine that inspects the traffic on one network and compares it against a set of rules.
On most devices, sending firewall blocks is worth turning on straight away. Add alerts where you want traffic inspected.
Turning it on¶
- Tick Send security events from this device.
- Fill in the Detection server address, its Port and Transport. The default, 1514 over TCP (reliable), is almost always right; 1514 keeps security events apart from the ordinary log stream on 514.
- Under What to send, tick Firewall blocks, Attack alerts, or both.
- For alerts, choose the Network to watch.
- Apply Changes and Confirm. The device installs what it needs by itself.
UDP drops events when they matter
UDP discards messages silently when the network is busy, which is exactly what happens during an attack. Use TCP unless your server cannot accept it.
Which network to watch¶
The engine watches one network.
| Watching | What you learn |
|---|---|
| An inside network | Which of your machines is affected: a compromised laptop, a device talking somewhere it should not |
| The internet side | Attacks arriving from outside, mostly background noise, without saying which of your machines was involved |
Start with an inside network. VPN and tunnel interfaces are not offered, because the engine cannot read their traffic. If nothing can be watched, the page says This device has no network the engine can watch.
Devices with too little memory¶
If the device reports too little free memory (the engine needs about 400 MB), Attack alerts cannot be ticked and the page says how much the device has. Firewall blocks still work.
Checking that it works¶
A quiet detection system and a broken one look the same, so the starter rules include a self-test that alerts on a ping.
Once a network is chosen, the page says where to ping: anything on the watched network, across the interface the engine watches. The engine only sees that one segment, so a ping to the device's other addresses produces nothing. The test alert should reach your detection server within seconds.
What arrives at your server¶
Events arrive as syslog messages, tagged by stream and by device, so one dashboard can serve a whole fleet:
DIGILAN-ALERT: device=gw-ec4d3009 {"event_type":"alert","src_ip":"192.168.30.44", ...}
DIGILAN-BLOCK: device=gw-ec4d3009 rule 4/(match) block in on igc0: 203.0.113.9 > ...
Alerts are JSON, one object per line. Blocks are in the firewall's own log format.
If nothing arrives, check first that your server accepts connections from the gateway on the configured port. The gateway does not report a collector that is not listening.
The rules¶
The engine comes with a small, conservative starter set: the self-test, a known malware test file, port scans, repeated remote-access attempts, and protocols that send passwords in clear. It is chosen to rarely raise false alarms; it does not recognise current attacker tooling and is not a complete detection system.
What this does not do¶
- It does not block. Your firewall rules decide what is allowed.
- It does not inspect encrypted traffic. It sees that a connection happened, to where, and how much.
- It watches one network, not every network on the device.