NSF IP Naming

Show author only · Posted 2024-May-09 10:31

May I know if the Sangfor NSF can do IP naming? If yes, does it be reflected on the logs or sessions? Please share your idea

Show author only · Posted 2024-May-09 14:38

yes sangfor nsf can do ip naming , use network object and ip binding

Show author only · Posted 2024-May-09 14:39

Hi, what do you mean for ip naming?
On Sangfor NGAF,you have the option to set up DNAT with a DDNS hostname instead of a fixed public IP address. This method eliminates the need for manual updates to the DNAT configuration when your public IP address alters. The process involves creating a DNS record for your DDNS hostname that directs to your public IP address. After setting this up, the DDNS hostname can be used as the destination address in the DNAT configuration. This solution helps maintain the DNAT configuration without manual intervention even when your public IP address changes. However, it’s crucial to remember that this method is only effective if your ISP permits the creation of static IP aliases.

Show author only · Posted 2024-May-09 14:51

Sangfor Network Security Framework (NSF) supports IP naming, allowing users to assign readable labels to IP addresses, aiding in network device identification. These named IPs are reflected in logs, enhancing visibility into network activity. Sangfor NGAF logs vary by source and category, encompassing system info, alert events, traffic data, and security events. Logs contain details like firewall matches, denied/allowed connections, IPS alerts, and more, providing valuable insights for monitoring and security.

Show author only · Posted 2024-May-09 16:50

Hi,
As i understand the question, you want to create rules and see logs with names instead of ips. Usually firewalls works only with IPs for security reasons.

Thanks.

Show author only · Posted 2024-May-09 18:20

Hi Ronnel, the main purpose to create netowrk object is to reuse it on many policies and if you have to modify this object, you simply modifiy the object without checking and modify the policies that this object is used.

On ngaf 8.0.85 you can create network object as follows:

you can see the logs related to netowrk client activity here on monitor page

Here instead, you can see the firewall related activity logs:

Show author only · Posted 2024-May-11 18:45

Hi,

NSF works with SSO to minimize the amount of time a network is unavailable to its users following a switchover. The main objective of Cisco NSF is to continue forwarding IP packets following a route processor (RP) switchover. Usually, when a networking device restarts.

Show author only · Posted 2024-May-11 19:20

Hi,
Based on the available information, Sangfor NSF (Network Secure Firewall) likely doesn't support IP naming directly. Here's why:

Focus on Security: Sangfor NSF is primarily focused on network security functionalities like intrusion prevention, malware detection, and firewall management. IP naming is more on the network management side.
Documentation and Community Discussions: There's no mention of IP naming in Sangfor's documentation or discussions within the Sangfor community forum.
However, there are alternative approaches to achieve a similar outcome:

DNS Server Integration: You can integrate Sangfor NSF with your organization's DNS server. This allows Sangfor NSF to leverage existing DNS hostnames for devices instead of relying solely on IP addresses. This would be reflected in logs that reference hostnames instead of IPs.
Network Management System (NMS): If you have a separate NMS, it might offer IP naming functionality. You can configure the NMS to provide Sangfor NSF with contextual information about devices, including hostnames.
Overall, Sangfor NSF itself likely wouldn't perform IP naming, but integration with other tools can achieve a similar result.