BLUEMAX NGF

Changelog

• Added support for WELF log format
• Fixed log schema display names
• Added 7 new log schemas
  • Blacklist (fw4_blacklist)
  • FQDN management (fqdn_management)
  • QoS counter (qos_cnt)
  • SSL VPN client profile (sslvpn_client_resource)
  • SSL VPN tunnel monitoring (sslvpn_monitoring)
  • SSL VPN user auth (sslvpn_user_auth)
  • Web filter (urlblock)

Bug fix

• Fixed issue for some query commands not showing proper query plan
• Fixed issue where time filter was not being applied on the dashboard

Before updating the app, delete the Bluemax NGF app dashboard and update the app for the dashboard to show correct log schema display names

Support for executing app query commands through forwarders.

• Logpresso Sonar 4.0.2502.0 and later is required

Support four additional formats of V3.5.1 firmware

• HA event logs (ha_event)
• Oversubscription statistics log (oversubscription_cnt)
• Daemon monitor logs (daemon_cnt)
• Performance logs (resource_cnt)
• Alertlogs (alert)

Apply directionality when deleting (unblocking) an address group

Support BLUEMAX NGF v3.5.1 firmware.

• Added fw_rule_dir field when parsing fw4_allow, fw4_deny, fw6_allow, fw6_deny log types.
• Changed start_time, end_time field types to date type.
• Changed device_ip field type to IP address type.

Changelog

• Added blocking direction option to response configuration.
• Added wildcard namespace to dataset configurations.

Support four additional formats of V2.8.3 firmware

• Added audit, dns_security, ips_ddos_detect, ips_ddos_incident log types
• Added four log schema
• Added Attack Dashboard

Added guids to logger model.

Add the action field when parsing the nat_session log type.

Support new session log format of V2.5 firmware

• Added host, src_country, dst_country fields to fw4_allow, fw4_deny, fw6_allow, fw6_deny log types

Added Sonar app manifest.

Added parsers, log schemas, dashboards.

• High performance log parser
• Log Schemas
  • BLUEMAX NGF HA Status
  • BLUEMAX NGF HA Traffic Statistics
  • BLUEMAX NGF Interface Statistics
  • BLUEMAX NGF NAT Rule Statistics
  • BLUEMAX NGF NAT Traffic Statistics
  • BLUEMAX NGF Performance
  • BLUEMAX NGF Rule Statistics
  • BLUEMAX NGF Traffic Statistics
• Traffic, Performance, HA dashboards

Changes

• Added idle timeout option for BLUEMAX NGF session.
• Added expiration period option for BLUEMAX blacklist registration.
• Fixed concurrency error when executing multiple BLUEMAX NGF commands at the same time.

Added missing output fields:

• Added missing output fields to bluemax-ngf-add-blacklist-rule command.
• Added profile field to output of bluemax-ngf-blacklist-rules command.
• Added profile field to output of bluemax-ngf-system-time command.
• Added profile field to output of bluemax-ngf-system-info command.

Changes

• Supports blacklist object instead of IP group object for IP blacklist synchronization.
• Supports IP block exception configuration to prevent human error.
• Supports also following commands:
  • bluemax-ngf-accounts
  • bluemax-ngf-blacklist-rules
  • bluemax-ngf-add-blacklist-rule
  • bluemax-ngf-remove-blacklist-rule
  • bluemax-ngf-session-logs
  • bluemax-ngf-system-info
  • bluemax-ngf-system-status
  • bluemax-ngf-system-time

First release. Support following commands:

• bluemax-ngf-add-host-object
• bluemax-ngf-add-host-to-group
• bluemax-ngf-address-group-members
• bluemax-ngf-address-groups
• bluemax-ngf-firewall-rules
• bluemax-ngf-host-objects
• bluemax-ngf-remove-host-from-group
• bluemax-ngf-remove-host-object