network.versa
The tags beginning with network.versa identify log events generated by the following Versa technologies:
Versa SD-WAN
Versa NGFW
Versa IDP
Versa CGNAT
Versa AV
Tag structure
The full network.versa tags have four levels. The first two are fixed as network.versa. The third level identifies the technology type and must be one of ngfw, sdwan, cgnat, av or idp.
technology | brand | type | group |
|---|---|---|---|
network | versa | ngfw |
|
| - | - | sdwan |
|
| - | - | cgnat | events |
| - | - | av | events |
| - | - | idp | events |
Therefore, the valid tags include:
network.versa.ngfw.access
network.versa.ngfw.identification
network.versa.ngfw.urlfiltering
network.versa.sdwan.traffic
network.versa.sdwan.slaviolation
network.versa.sdwan.b2bslam
network.versa.cgnat.events
network.versa.av.events
network.versa.idp.events
For more information, read more about Devo tags.
Devo relay rules
You will need to define relay rules that can correctly identify the event type and apply the corresponding tag.
We'll use mostly type-2 relay rules that apply a fixed tag based upon specific data contained in the inbound event and all rules are defined on the same port. In this example, we're using port 13030, but you can use any free port on your relay.
These instructions cover all of the event types.
Rule 1: Versa NGFW Access
Source Port → 13030
Source Data → (.*)accessLog, applianceName=(.*)
Target Tag → network.versa.ngfw.access
Select the Stop Processing and Sent without syslog tag checkboxes
Rule 2: Versa NGFW Identification
Source Port → 13030
Source Data → (.*)flowIdLog, applianceName=(.*)
Target Tag → network.versa.ngfw.identification
Select the Stop Processing and Sent without syslog tag checkboxes
Rule 3: Versa NGFW Url Filtering
Source Port → 13030
Source Data → (.*)urlfLog, applianceName=(.*)
Target Tag → network.versa.ngfw.urlfiltering
Select the Stop Processing and Sent without syslog tag checkboxes
Rule 4: Versa SDWAN Traffic
Source Port → 13030
Source Data → (.*)flowMonLog, applianceName=(.*)
Target Tag → network.versa.sdwan.traffic
Select the Stop Processing and Sent without syslog tag checkboxes
Rule 5: Versa SDWAN Sla Violation
Source Port → 13030
Source Data → (.*)sdwanSlaPathViolLog, applianceName=(.*)
Target Tag → network.versa.sdwan.slaviolation
Select the Stop Processing and Sent without syslog tag checkboxes
Rule 6: Versa SDWAN B2B Slam
Source Port → 13030
Source Data → (.*)sdwanB2BSlamLog, applianceName=(.*)
Target Tag → network.versa.sdwan.b2bslam
Select the Stop Processing and Sent without syslog tag checkboxes
Rule 7: Versa CGNAT Events
Source Port → 13030
Source Data → (.*)cgnatLog, applianceName=(.*)
Target Tag → network.versa.cgnat.events
Select the Stop Processing and Sent without syslog tag checkboxes
Rule 8: Versa AV Events
Source Port → 13030
Source Data → (.*)avLog, applianceName=(.*)
Target Tag → network.versa.av.events
Select the Stop Processing and Sent without syslog tag checkboxes
Rule 9: Versa IDP Events
Source Port → 13030
Source Data → (.*)idpLog, applianceName=(.*)
Target Tag → network.versa.idp.events
Select the Stop Processing and Sent without syslog tag checkboxes
