Firewall and Routing Requirements for Outbound Syslog Forwarding in VMware Aria Operations for Logs

Products

• VCF Operations

Issue/Introduction

When configuring outbound syslog forwarding from VMware Aria Operations for Logs, there may be uncertainty about whether syslog traffic originates from the Virtual IP (VIP) or the individual node IP addresses within the cluster. 
This can lead to incorrect firewall or routing configurations, particularly because the Send Test Message option in the user interface indicates that the test message is sent through the VIP, while actual syslog traffic may originate from node IP addresses.

Incorrect firewall or reverse routing configurations can result in failed log forwarding.

Environment

VMware Aria Operations for Logs 8.x

Resolution

To ensure successful outbound syslog forwarding, apply the following configuration guidelines:

• Configure firewall rules to allow outbound syslog traffic from both the VIP and all individual node IP addresses in the Aria Operations for Logs cluster to the destination syslog server. Allowing traffic only from the VIP is insufficient, as production log forwarding is performed by the cluster nodes.
• The Send Test Message option in the Aria Operations for Logs user interface is designed to use the VIP. This behavior is expected and does not represent the source IP used for ongoing syslog forwarding.
• Configure the reverse route on the remote syslog server to point to the VIP of the Aria Operations for Logs cluster rather than individual node IP addresses. Routing through the VIP ensures proper failover and consistent communication across the cluster.
• For single-node deployments configured with a VIP, it is also recommended to configure the reverse route to the VIP. This avoids future routing changes if the deployment is expanded into a multi-node cluster, as the VIP continues to manage traffic and failover without requiring additional network reconfiguration.

Additional Information

This behavior is expected by design and should be considered when planning firewall and routing policies for outbound syslog forwarding.
For more information on configuring log forwarding, refer to Add a VMware Aria Operations for Logs Log Forwarding Destination.