Ssl – SonicWall SSL VPN Log Export

log-filesloggingsslvpn

I would like to automatically pull the log file out of my SonicWall SSL VPN. If I login to the interface, I am able to click an export button and download a file I can process; however, I cannot find any way to automatically download this file.

I've tried using Fiddler to track down where it comes from, but with no luck.

I would be OK with the SonicWall dropping the file on a file server or having my process utility download it from the SonicWall.

I see options for Syslog server [not exactly sure how that works] and for emailing the log file, neither of these options fits what I want to do very well. But if you could shed some light on syslog servers that may get me going down the right path.

My end goal is to read this log file and stuff it into my own database.

Any help on this issue is greatly appreciated.

Best Answer

fuzzered, really syslog is your best option. All firewalls should be syslogged. Check out Kiwi Syslog. Use the free version and you will have all of the logged data you need. You can even change the format it is in. Just download it to any server or desktop and point your sonicwall to it.

Related Solutions

Sonicwall SSL VPN: Unable to reconnect once connection drops

I wish I had a more complete answer for you, but I have the same problem, and it's not 100% resolved.

I have had some success with a simple reboot: close NetExtender, Reboot. Try again.

I have had some seemingly random success. I would just try and try and eventually it would work. I thought this might be related to time so I checked the config on the firewall and DC and everything was in perfect sync, so I don't think that is the issue.

This problem seemed to start after enabling LDAP+LocalUsers Auth (was LocalUsers). It is possible the problem is related to Auth scheme.

Another possibility I haven't been able to test yet, related to the above, is that the reason is related to the computer trying to connect not being a member of the domain. The workstations I am testing from are not domain joined (to the domain doing the LDAP auth). However, the issue is the same when using a "LocalUser" from the sonicwall device.

I have also tried the version of NetEx that gets installed from the portal, as well as the latest version from mysonicwall.

I hope some of those clues will help you.

Ssl – Apache SSL Log Incomplete SSL Handshake

SSL connections have extra options for CustomLog but they're not going to break down the step-by-step connection status. You'll probably want to try LogLevel debug, but that will get you plenty of extra junk to wade through.

Honestly, a better idea for this class would be to demonstrate using the openssl s_server command, since it can be configured to show the step-by-step progress of the SSL state machine, you'll be able to see exactly at what step the client dropped the connection.

Something like

openssl s_server -key [somekey.pem] -cert [somecert.pem] -accept 443 -state -www

When someone connects it'll print off the steps of the connection:

SSL_accept:before/accept initialization
SSL_accept:SSLv3 read client hello A
SSL_accept:SSLv3 write server hello A
SSL_accept:SSLv3 write certificate A
SSL_accept:SSLv3 write key exchange A
SSL_accept:SSLv3 write server done A
SSL_accept:SSLv3 flush data
SSL_accept:SSLv3 read client key exchange A
SSL_accept:SSLv3 read finished A
SSL_accept:SSLv3 write change cipher spec A
SSL_accept:SSLv3 write finished A
SSL_accept:SSLv3 flush data

the -www option makes it print some information when someone actually connects to it with a webbrowser. If the user navigates away without accepting the fake cert, then I'm guessing the connection will be broken somewhere in the middle there.

You can use the openssl s_client command in a similar fashion, though I'm not certain how flexible it is about accepting or not accepting invalid certificates.

Best Answer

Related Solutions

Sonicwall SSL VPN: Unable to reconnect once connection drops

Ssl – Apache SSL Log Incomplete SSL Handshake

Related Topic