How do I determine which type of profile to create?

This article applies to:

• Firewall Suite 4.x

Question:

Procedure:

Firewall Suite gives the option to produce reports based on three different types of profiles. In most cases, all use the same log file for analysis; however, each will yield unique and significantly different reports.

• The Incoming Web Activity cartridge supports the creation of Incoming Firewall Activity profiles and reports. This report displays incoming web activity only. It reports on incoming activity from visitors to your web site. If your web server is NOT behind the firewall, or if you do not identify what IP addresses exist behind the firewall, this report will display zeros for all activity.

• The Outgoing Firewall Activity cartridge supports the creation of Outgoing Firewall Activity profiles and reports. This report displays outgoing web activity only.  A good way to utilize this report is to record employee activity/usage of those protocols.

• The General Firewall Activity cartridge provides general firewall statistics on such things as protocol usage (HTTP, FTP, E-MAIL, VPN, TELNET, etc.), bandwidth usage, errors returned by the server, and potential security issues. It also, reports on (some) incoming and outgoing Web activity, but not in significant detail.

You can see from the descriptions above that each profile has a specific focus. Which profile you choose, therefore, will depend upon what you want to analyze, and (in some cases) what firewall or proxy log file you have to work with.

• FOCUS OF REPORT. If your goal is to track employee usage of the Internet, you will want to create an Outgoing Firewall Activity Profile to capture outgoing web activity. The resulting report will identify who within your organization uses the Internet, where they go and how long they stay. It will also, report on outgoing FTP usage. When utilized in conjunction with a General Firewall report, it provides management an effective tool to help assess employee productivity.

• FIREWALL/PROXY SERVER. If you are trying to analyze Novell Border Manager, Microsoft Proxy Server or Netscape Proxy Server log files, you do not have a lot of choice about which type of report to produce. Those applications record proxy (outgoing) activity only. They contain no information about incoming web activity. Therefore, the only report option available will be Outgoing Firewall Activity Report.

Note: If you want to analyze outgoing firewall activity, one of the most important steps in the process (and the one most often overlooked) is to identify the IP addresses behind the firewall. Otherwise, Firewall Suite cannot distinguish incoming from outgoing firewall activity. To specify IP addresses behind the firewall:

• Open the Firewall Suite application.
• Select the appropriate outgoing web activity profile.
• Click on the Edit button.
• Click on the IPs Behind Firewall tab.
• Enter the IP addresses or domain names that exist behind your firewall.
• The Help button in that window offers examples and syntax information.

This article was previously published as:

NETIQKB2539