Implement solution to send access log/syslog data/traffic to a SIEM server from the Proxy's management interface rather than the default LAN interface.
Article ID: 277740
Updated On:
Products
Issue/Introduction
Implementing what path a particular traffic leaves the Edge SWG appliance is a matter of network routing. Because the appliance itself works as a network router and can receive and store network routes, this solution is possible.
Resolution
Specifically, you will need to to have a static route added on the Proxy, to have any traffic going to the access log upload client, go through the management IP address of the appliance. Because traffic for web requests get sent from the LAN interface and through the configured default gateway by default, you will have the also have a similar static route configured on the Proxy's default gateway, to route the return traffic from the syslog server to the Proxy via the same management IP address/interface.
For general guidance on how you may configure network routing on the Proxy, please refer to the Tech. Article with the URLs below.
https://knowledge.broadcom.com/external/article/165653/defining-a-static-routing-table-on-the-p.html
https://knowledge.broadcom.com/external/article/175295/add-a-static-route-for-a-routing-domain.html
Note: You are able to check how the traffic flows by running the traceroute CLI command from the Proxy. It's important to note that static routing should be implemented on all of the network nodes that are in the traffic path. More so, you can test this to see whether your routing implementation works.
Feedback
