Integrating Nortel Switched Firewall by using syslog

This method ensures the IBM QRadar Nortel Switched Firewall 5100 DSM accepts events by using syslog.

1. Log into your Nortel Switched Firewall device command-line interface (CLI).
2. Type the following command:

   /cfg/sys/log/syslog/add

3. Type the IP address of your QRadar system at the following prompt:

   Enter IP address of syslog server:

   A prompt is displayed to configure the severity level.

4. Configure info as the severity level.

   For example, Enter minimum logging severity

   (emerg | alert | crit | err | warning | notice | info | debug): info

   A prompt is displayed to configure the facility.

5. Configure auto as the local facility.

   For example, Enter the local facility (auto | local0-local7): auto

6. Apply the configuration:

   apply

7. Repeat for each firewall in your cluster.

   You are now ready to configure the log source in QRadar.

8. To configure QRadar to receive events from a Nortel Switched Firewall 5100 device by using syslog: From the Log Source Type list, select the Nortel Switched Firewall 5100 option.