Link Virtual Decoder to Physical Decoder

[ClementCheeSeng]

Hi All,

           Currently my SA setup is as per below:

                Virtual Decoder ----> Physical Decoder

             I would need to change to the following:

                Virtual Decoder ----> Data Diode -----> Physical Decoder

              Where do i go to perform the change to point the Virtual Decoder to the Data Diode ? 

[DaveGlover]

Clement

Log Decoders do not point to other Log Decoders.  The typical Flow is VLC -> Log Decoder -> Concentrator.

Can you please clarify exactly what you have?

Thanks

Dave

[ClementCheeSeng]

Hi Dave,

                My Data Flow is VLC -> Virtual  Log Decoder -> Data diode -> Physical  Log Decoder ->Concentrator.  

                 The Data Diode is use to force data to go in one direction only.

                 Or are you able to advise where do  i go to change the configuration of the VLC --> Log decoder  and  Log Decoder -> Concentrator ?

Thanks 

Clement 

[JohnKisner]

Clement,

Netwitness does not support having items like Data Diodes between the appliances. Data has to flow in both directions between the services. Putting something like this between the services, is not a tested configuration and RSA Netwitness Support will not be able to provide support for troubleshooting issues between any VLC and Log Decoder that has a Data Diode between them.

If you do figure out a way to configure this, you do so at your own risk. If troubleshooting is require for issues that appear after such a configuration you may be asked to restore the original supported configuration before any troubleshooting can be performed.

[EricPartington]

IF the source traffic is syslog can you use an rsyslog server inside your protected zone to collect and forward the logs over syslog on the ports you mentioned (514, 515 or 516) to your NW systems on the other side of the data diode?  UDP 514 would be one way only (with the risk of loss if something failed) and would satisfy your requirement.  That way you have one central spot that you can point to (replacing the VLC) and forward over a protocol that is friendlier to the data diode (I hope) than trying to for VLC into one way communication which will not work well (if at all).  There is a ports and service page listed here which shows the ports and directionality required (one way from VLC is not how the system was designed).

https://community.rsa.com/docs/DOC-42654