H3C Technologies H3C SecCenter UTM Manager - Manual (Page 241)

233
Configuration example 1
Network requirements
H3C SecCenter UTM Manager works with UTM devices.
The UTM Manager collects logs sent by UTM devices, processes and analyzes the collected data, and
presents the information to the UTM Manager users.
You need to ensure that the SecCenter can receive logs from each managed UTM device.
Configuring the UTM devices
After the devices are well connected, you need to perform some basic configurations on the UTM devices
so that the SecCenter can manage them. The configurations for each UTM device include:
1. Assigning an IP address to the management interface of the device.
2. Setting the IP address of the stream log server to that of the SecCenter server, port number to
30010, and log sending interval to 5 minutes.
3. Enabling link logging, user logging, and session logging.
4. Selecting the option of sending stream logs.
5. Setting the system time of the device. Note that the system time of the device must be consistent with
that of the SecCenter. Otherwise, the UTM Manager cannot collect statistics normally.
6. Setting the IP address of the Syslog server to that of the SecCenter server, and the port number to
30514.
7. Setting port number to 30017 for NAT logs.
For detailed configurations of UTM devices, see UTM device configuration manuals.
Adding the UTM devices to the UTM Manager
Adding devices to H3C SecCenter is the prerequisite to other operations, such as querying information
based on the devices. This section describes how to add devices to the H3C SecCenter:
1. Select the system management component, and then select Device List under Device Management
to enter the device management page. Then, click Add to enter the page for adding a device, as
shown in Figure 230 . Generally, you can simply input the IP address and label (a string for
identifying a device) of a device, leaving other fields with the default settings.