Secure audit log streaming

Configure secure audit log streaming to ensure that audit logs are transmitted safely between the Cloud-Delivered Firewall Management Center and a trusted server.

When you stream the audit log to a trusted HTTP server or syslog server, use Transport Layer Security (TLS) certificates to secure the channel between the Cloud-Delivered Firewall Management Center and the server.

You must generate a unique client certificate for each appliance you want to audit. Mutual authentication requires the client certificate to be signed by the same CA as the server certificate. For more considerations on client and server certificate requirements, refer to Audit log certificates.

Before you begin

Refer to ramifications of requiring client and server certificates at Audit log certificates. Ensure you have access to a recognized certificate authority (CA) for signing client certificates.

Follow these steps to secure audit log streaming.

Procedure

Step 1

Obtain and install a signed client certificate on the Cloud-Delivered Firewall Management Center.

  1. Obtain a signed audit log client certificate for the Cloud-Delivered Firewall Management Center:

    Generate a Certificate Signing Request (CSR) from the Cloud-Delivered Firewall Management Center based on your system information and the identification information you supply.

    • Submit the CSR to a recognized, trusted certificate authority (CA) to request a signed client certificate.

    • If you will require mutual authentication between the Cloud-Delivered Firewall Management Center and the audit log server, ensure the client certificate is signed by the same CA that signed the server certificate.

  2. After you receive the signed certificate from the certificate authority, import it into the Cloud-Delivered Firewall Management Center. Refer to Import an audit log client certificate into the Cloud-Delivered Firewall Management Center.

Step 2

Configure the communication channel with the server to use Transport Layer Security (TLS) and enable mutual authentication.

Step 3

If you have not yet configured audit log streaming, do so now.

Refer to Stream audit logs to syslog or Stream audit logs to an HTTP server.

Audit logs are securely streamed to the trusted server using TLS, with mutual authentication enabled. The Cloud-Delivered Firewall Management Center and the server verify each other's certificates, ensuring secure transmission and integrity of audit log data.

What to do next

Monitor the audit log streaming status and verify certificate validity periodically. Renew client and server certificates before expiration to maintain secure log streaming.