请问FW_1000 防火墙自带有500G硬盘
- 0关注
- 0收藏，30浏览
问题描述：
请问FW_1000 防火墙自带有500G硬盘，如何设置可以让他存储1300终端用户每日的访问日志或者流量日志便于后续中毒的终端追溯啊？目前配置以后安全策略日志只能存储到11%但是设置上限是存储50% 180天，实测只能查到39天之前的日志。流量日志设置上限100%但是只能存到43%就上不去了，只能查65天之前的流量日志。会话列表只能查到一周内的部分会话记录，web页面看到存储空间每天都是剩余44%空间无法使用。请问是否两个日志功能重叠了？为了能查到180天的用户访问记录。请问应该怎么配置合适呢？只开一个也可以。
组网及组网描述：
AvG.163.com/TOPic/dEtAil/11427198
AvG.163.com/TOPic/dEtAil/11427250
AvG.163.com/TOPic/dEtAil/11427299
AvG.163.com/TOPic/dEtAil/11427350
AvG.163.com/TOPic/dEtAil/11427403
AvG.163.com/TOPic/dEtAil/11427204
AvG.163.com/TOPic/dEtAil/11427269
AvG.163.com/TOPic/dEtAil/11427309
AvG.163.com/TOPic/dEtAil/11427352
AvG.163.com/TOPic/dEtAil/11427404
AvG.163.com/TOPic/dEtAil/11427209
AvG.163.com/TOPic/dEtAil/11427251
AvG.163.com/TOPic/dEtAil/11427328
AvG.163.com/TOPic/dEtAil/11427390
AvG.163.com/TOPic/dEtAil/11427435
AvG.163.com/TOPic/dEtAil/11427201
AvG.163.com/TOPic/dEtAil/11427261
AvG.163.com/TOPic/dEtAil/11427311
AvG.163.com/TOPic/dEtAil/11427355
AvG.163.com/TOPic/dEtAil/11427398
AvG.163.com/TOPic/dEtAil/11427231
AvG.163.com/TOPic/dEtAil/11427249
AvG.163.com/TOPic/dEtAil/11427220
AvG.163.com/TOPic/dEtAil/11427321
AvG.163.com/TOPic/dEtAil/11427246
AvG.163.com/TOPic/dEtAil/11427354
AvG.163.com/TOPic/dEtAil/11427316
AvG.163.com/TOPic/dEtAil/11427410
AvG.163.com/TOPic/dEtAil/11427361
AvG.163.com/TOPic/dEtAil/11427399
AvG.163.com/TOPic/dEtAil/11427230
AvG.163.com/TOPic/dEtAil/11427281
AvG.163.com/TOPic/dEtAil/11427331
AvG.163.com/TOPic/dEtAil/11427428
AvG.163.com/TOPic/dEtAil/11427218
AvG.163.com/TOPic/dEtAil/11427272
AvG.163.com/TOPic/dEtAil/11427367
AvG.163.com/TOPic/dEtAil/11427413
AvG.163.com/TOPic/dEtAil/11427214
AvG.163.com/TOPic/dEtAil/11427254
AvG.163.com/TOPic/dEtAil/11427322
AvG.163.com/TOPic/dEtAil/11427375
AvG.163.com/TOPic/dEtAil/11427421
AvG.163.com/TOPic/dEtAil/11427221
AvG.163.com/TOPic/dEtAil/11427310
AvG.163.com/TOPic/dEtAil/11427371
AvG.163.com/TOPic/dEtAil/11427197
AvG.163.com/TOPic/dEtAil/11427257
AvG.163.com/TOPic/dEtAil/11427305
AvG.163.com/TOPic/dEtAil/11427349
AvG.163.com/TOPic/dEtAil/11427396
AvG.163.com/TOPic/dEtAil/11427226
AvG.163.com/TOPic/dEtAil/11427282
AvG.163.com/TOPic/dEtAil/11427330
AvG.163.com/TOPic/dEtAil/11427387
AvG.163.com/TOPic/dEtAil/11427431
AvG.163.com/TOPic/dEtAil/11427274
AvG.163.com/TOPic/dEtAil/11427243
AvG.163.com/TOPic/dEtAil/11427318
AvG.163.com/TOPic/dEtAil/11427295
AvG.163.com/TOPic/dEtAil/11427434
AvG.163.com/TOPic/dEtAil/11427381
AvG.163.com/TOPic/dEtAil/11427451
AvG.163.com/TOPic/dEtAil/11427447
AvG.163.com/TOPic/dEtAil/11427449
AvG.163.com/TOPic/dEtAil/11427205
AvG.163.com/TOPic/dEtAil/11427245
AvG.163.com/TOPic/dEtAil/11427298
AvG.163.com/TOPic/dEtAil/11427348
AvG.163.com/TOPic/dEtAil/11427400
AvG.163.com/TOPic/dEtAil/11427207
AvG.163.com/TOPic/dEtAil/11427258
AvG.163.com/TOPic/dEtAil/11427312
AvG.163.com/TOPic/dEtAil/11427368
AvG.163.com/TOPic/dEtAil/11427418
AvG.163.com/TOPic/dEtAil/11427217
AvG.163.com/TOPic/dEtAil/11427314
AvG.163.com/TOPic/dEtAil/11427370
AvG.163.com/TOPic/dEtAil/11427420
AvG.163.com/TOPic/dEtAil/11427206
AvG.163.com/TOPic/dEtAil/11427268
AvG.163.com/TOPic/dEtAil/11427308
AvG.163.com/TOPic/dEtAil/11427364
AvG.163.com/TOPic/dEtAil/11427414
AvG.163.com/TOPic/dEtAil/11427223
AvG.163.com/TOPic/dEtAil/11427265
AvG.163.com/TOPic/dEtAil/11427307
AvG.163.com/TOPic/dEtAil/11427358
AvG.163.com/TOPic/dEtAil/11427401
AvG.163.com/TOPic/dEtAil/11427212
AvG.163.com/TOPic/dEtAil/11427252
AvG.163.com/TOPic/dEtAil/11427302
AvG.163.com/TOPic/dEtAil/11427408
AvG.163.com/TOPic/dEtAil/11427253
AvG.163.com/TOPic/dEtAil/11427319
AvG.163.com/TOPic/dEtAil/11427359
AvG.163.com/TOPic/dEtAil/11427409
AvG.163.com/TOPic/dEtAil/11427240
AvG.163.com/TOPic/dEtAil/11427284
AvG.163.com/TOPic/dEtAil/11427336
AvG.163.com/TOPic/dEtAil/11427393
AvG.163.com/TOPic/dEtAil/11427437
AvG.163.com/TOPic/dEtAil/11427208
AvG.163.com/TOPic/dEtAil/11427273
AvG.163.com/TOPic/dEtAil/11427360
AvG.163.com/TOPic/dEtAil/11427402
AvG.163.com/TOPic/dEtAil/11427233
AvG.163.com/TOPic/dEtAil/11427286
AvG.163.com/TOPic/dEtAil/11427335
AvG.163.com/TOPic/dEtAil/11427389
AvG.163.com/TOPic/dEtAil/11427438
AvG.163.com/TOPic/dEtAil/11427235
AvG.163.com/TOPic/dEtAil/11427259
AvG.163.com/TOPic/dEtAil/11427323
AvG.163.com/TOPic/dEtAil/11427363
AvG.163.com/TOPic/dEtAil/11427407
AvG.163.com/TOPic/dEtAil/11427213
AvG.163.com/TOPic/dEtAil/11427275
AvG.163.com/TOPic/dEtAil/11427315
AvG.163.com/TOPic/dEtAil/11427373
AvG.163.com/TOPic/dEtAil/11427440
AvG.163.com/TOPic/dEtAil/11427228
AvG.163.com/TOPic/dEtAil/11427278
AvG.163.com/TOPic/dEtAil/11427326
AvG.163.com/TOPic/dEtAil/11427427
AvG.163.com/TOPic/dEtAil/11427224
AvG.163.com/TOPic/dEtAil/11427279
AvG.163.com/TOPic/dEtAil/11427327
AvG.163.com/TOPic/dEtAil/11427379
AvG.163.com/TOPic/dEtAil/11427425
AvG.163.com/TOPic/dEtAil/11427239
AvG.163.com/TOPic/dEtAil/11427287
AvG.163.com/TOPic/dEtAil/11427338
AvG.163.com/TOPic/dEtAil/11427386
AvG.163.com/TOPic/dEtAil/11427436
AvG.163.com/TOPic/dEtAil/11427227
AvG.163.com/TOPic/dEtAil/11427256
AvG.163.com/TOPic/dEtAil/11427301
AvG.163.com/TOPic/dEtAil/11427362
AvG.163.com/TOPic/dEtAil/11427412
AvG.163.com/TOPic/dEtAil/11427237
AvG.163.com/TOPic/dEtAil/11427291
AvG.163.com/TOPic/dEtAil/11427372
AvG.163.com/TOPic/dEtAil/11427422
AvG.163.com/TOPic/dEtAil/11427445
AvG.163.com/TOPic/dEtAil/11427202
AvG.163.com/TOPic/dEtAil/11427248
AvG.163.com/TOPic/dEtAil/11427290
AvG.163.com/TOPic/dEtAil/11427296
AvG.163.com/TOPic/dEtAil/11427347
AvG.163.com/TOPic/dEtAil/11427397
AvG.163.com/TOPic/dEtAil/11427234
AvG.163.com/TOPic/dEtAil/11427264
AvG.163.com/TOPic/dEtAil/11427306
AvG.163.com/TOPic/dEtAil/11427365
AvG.163.com/TOPic/dEtAil/11427415
AvG.163.com/TOPic/dEtAil/11427236
AvG.163.com/TOPic/dEtAil/11427280
AvG.163.com/TOPic/dEtAil/11427340
AvG.163.com/TOPic/dEtAil/11427384
AvG.163.com/TOPic/dEtAil/11427441
AvG.163.com/TOPic/dEtAil/11427325
AvG.163.com/TOPic/dEtAil/11427351
AvG.163.com/TOPic/dEtAil/11427238
AvG.163.com/TOPic/dEtAil/11427283
AvG.163.com/TOPic/dEtAil/11427333
AvG.163.com/TOPic/dEtAil/11427382
AvG.163.com/TOPic/dEtAil/11427433
AvG.163.com/TOPic/dEtAil/11427222
AvG.163.com/TOPic/dEtAil/11427288
AvG.163.com/TOPic/dEtAil/11427344
AvG.163.com/TOPic/dEtAil/11427394
AvG.163.com/TOPic/dEtAil/11427442
AvG.163.com/TOPic/dEtAil/11427232
AvG.163.com/TOPic/dEtAil/11427270
AvG.163.com/TOPic/dEtAil/11427341
AvG.163.com/TOPic/dEtAil/11427388
AvG.163.com/TOPic/dEtAil/11427432
AvG.163.com/TOPic/dEtAil/11427241
AvG.163.com/TOPic/dEtAil/11427285
AvG.163.com/TOPic/dEtAil/11427334
AvG.163.com/TOPic/dEtAil/11427383
AvG.163.com/TOPic/dEtAil/11427429
AvG.163.com/TOPic/dEtAil/11427225
AvG.163.com/TOPic/dEtAil/11427342
AvG.163.com/TOPic/dEtAil/11427392
AvG.163.com/TOPic/dEtAil/11427443
AvG.163.com/TOPic/dEtAil/11427448
AvG.163.com/TOPic/dEtAil/11427244
AvG.163.com/TOPic/dEtAil/11427293
AvG.163.com/TOPic/dEtAil/11427343
AvG.163.com/TOPic/dEtAil/11427423
AvG.163.com/TOPic/dEtAil/11427444
AvG.163.com/TOPic/dEtAil/11427229
AvG.163.com/TOPic/dEtAil/11427277
AvG.163.com/TOPic/dEtAil/11427320
AvG.163.com/TOPic/dEtAil/11427377
AvG.163.com/TOPic/dEtAil/11427426
AvG.163.com/TOPic/dEtAil/11427215
AvG.163.com/TOPic/dEtAil/11427271
AvG.163.com/TOPic/dEtAil/11427203
AvG.163.com/TOPic/dEtAil/11427332
AvG.163.com/TOPic/dEtAil/11427263
AvG.163.com/TOPic/dEtAil/11427385
AvG.163.com/TOPic/dEtAil/11427324
AvG.163.com/TOPic/dEtAil/11427430
AvG.163.com/TOPic/dEtAil/11427378
AvG.163.com/TOPic/dEtAil/11427424
AvG.163.com/TOPic/dEtAil/11427260
AvG.163.com/TOPic/dEtAil/11427317
AvG.163.com/TOPic/dEtAil/11427366
AvG.163.com/TOPic/dEtAil/11427417
AvG.163.com/TOPic/dEtAil/11427210
AvG.163.com/TOPic/dEtAil/11427294
AvG.163.com/TOPic/dEtAil/11427345
AvG.163.com/TOPic/dEtAil/11427411
AvG.163.com/TOPic/dEtAil/11427446
AvG.163.com/TOPic/dEtAil/11427242
AvG.163.com/TOPic/dEtAil/11427289
AvG.163.com/TOPic/dEtAil/11427337
AvG.163.com/TOPic/dEtAil/11427391
AvG.163.com/TOPic/dEtAil/11427439
AvG.163.com/TOPic/dEtAil/11427219
AvG.163.com/TOPic/dEtAil/11427262
AvG.163.com/TOPic/dEtAil/11427304
AvG.163.com/TOPic/dEtAil/11427369
AvG.163.com/TOPic/dEtAil/11427416
AvG.163.com/TOPic/dEtAil/11427199
AvG.163.com/TOPic/dEtAil/11427300
AvG.163.com/TOPic/dEtAil/11427353
AvG.163.com/TOPic/dEtAil/11427406
AvG.163.com/TOPic/dEtAil/11427247
AvG.163.com/TOPic/dEtAil/11427297
AvG.163.com/TOPic/dEtAil/11427346
AvG.163.com/TOPic/dEtAil/11427395
FW_1000防火墙虽自带500G硬盘，但日志存储能力受限于日志类型、日志生成速率及存储策略。针对1300终端用户的访问/流量日志长期留存（如180天）并支持溯源，建议按以下方式优化配置： 1. **调整日志存储上限与保留策略**： 进入“策略 > 日志管理 > 日志存储”，将日志存储上限设置为50%，并配置日志保留策略为“按时间保留180天”。系统会自动循环覆盖超过期限的日志。 2. **启用流量日志并合理配置**： 流量日志（Flow Log）远大于安全策略日志，建议： - 仅对关键区域或异常流量启用流量日志（如从Trust到Untrust域）； - 在“策略 > 安全策略”中，编辑策略勾选“记录流量日志”，并指定日志发送至日志服务器； - 避免全量终端开启流量日志，否则500G硬盘难以支撑1300终端长期存储。 3. **外接日志服务器（推荐）**： 本地存储有限，建议部署外置日志服务器（如华为HiSec Log或第三方SIEM）： - 配置防火墙将安全日志和流量日志通过Syslog发送至日志服务器； - 在防火墙配置域间策略，允许Local域到日志服务器所在域的通信（UDP 514等）； - 实现集中存储与分析，满足180天以上留存与终端溯源需求。 4. **检查日志缓存与实际存储**： 使用 `display logbuffer` 查看实时日志缓存，确认日志生成正常；通过日志管理界面查看实际存储使用情况。 **结论**：本地500G硬盘无法可靠支撑1300终端180天的全量日志存储。建议**限制本地仅存安全策略日志（保留90-180天）+ 流量日志外发至日志服务器**，以实现高效追溯。
编辑答案
亲~登录后才可以操作哦!
确定你的邮箱还未认证，请认证邮箱或绑定手机后进行当前操作
举报
×
侵犯我的权益
×
侵犯了我企业的权益
×
- 1. 您举报的内容是什么？（请在邮件中列出您举报的内容和链接地址）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
- 3. 是哪家企业？（营业执照，单位登记证明等证件）
- 4. 您与该企业的关系是？（您是企业法人或被授权人，需提供企业委托授权书）
抄袭了我的内容
×
原文链接或出处
诽谤我
×
- 1. 您举报的内容以及侵犯了您什么权益？（请在邮件中列出您举报的内容、链接地址，并给出简短的说明）
- 2. 您是谁？（身份证明材料，可以是身份证或护照等证件）
对根叔社区有害的内容
×
不规范转载
×
举报说明
暂无评论