PfSense Firewall
PfSense Firewall normalizes PfSense Firewall events and enables you to analyze PfSense Firewall data.
Package Details
PfSense Firewall components:
-
Normalization Packages
- LP_PfSense Firewall
- LP_PfSense Firewall Process
-
Label Package
- LP_PfSense Firewall
Enhancement
Description | Issue ID | Reference ID |
---|---|---|
Added Syslog Collector based PfSense Firewall log source template, simplifying the log source configuration process. To learn more, go to Creating Log Source via a Template. |
KB-22685 |
- |
Installation
To install PfSense Firewall:
- Download the .pak file from the Download link above.
- Go to Settings >> System Settings from the navigation bar and click Applications.
- Click Import.
- Browse to the downloaded .pak file.
- Click Upload.
Past Release
PfSense Firewall v5.0.1
Supported On: LogPoint v6.0.0 and later
Download: PfSense_Firewall_5.0.1.pak
SHA256: 14b43e7c7ed62497021d7b680e9c89c38c683e1209340bba0d0b3e8175b46a31
Enhancement
Description |
Issue ID |
Reference ID |
---|---|---|
Added new signatures in the LP_PfSense Firewall and LP_PfSense Firewall Process to normalize the PfSense logs. |
KB-13600, KB-15564 |
57743, 57902, 57905, 61881 |
Supported Version
PfSense Firewall
Log Format
Expected Log Format
PfSense Firewall Syslog Format
Log Sample
<134>Sep 9 09:49:03 pf: 934979 rule 78/0(match): pass in on bge0: (tos 0x0, ttl 120, id 2292, offset 0, flags [DF], proto TCP (6), length 52) 1.1.1.1.10560 > 1.1.1.2.443: S, cksum 0xba35 (correct), 3306015017:3306015017(0) win 8192 <mss 1260,nop,wscale 2,nop,nop,sackOK>
<30>1 2021-06-17T04:30:56.380289+02:00 host.xxx unbound 1769 - - [1769:3] info: incoming scrubbed packet: ;; ->>HEADER<<- opcode: QUERY, rcode: NOERROR, id: 0 ;; flags: qr rd ra ; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0 ;; QUESTION SECTION: xxxxx.xx.xxx.net. IN A ;; ANSWER SECTION: xxxxxxx.xx.xxxxx.net. 60 IN A xx.111.222.xx ;; AUTHORITY SECTION: ;; ADDITIONAL SECTION: ;; MSG SIZE rcvd: 57
<13>Jun 11 05:45:11 check_reload_status[377]: Reloading filter <13>Feb 7 15:03:20 check_reload_status: Reloading filter
Support
If you have any questions or require assistance, create a support ticket.
Comments
Article is closed for comments.