Alternate data collection methods

Relevant for: AFA Administrators

This section describes offline device data collection methods that can be used as alternates to on-boarding the device into AFA from the Administration area and collecting data automatically.

When to use these procedures

While we recommend that you generally collect data from live devices automatically, this requires that the AFA machine be connected to the device's network.

This may not always be possible, and you may want to analyze devices in a different location, or on a network that you are not able to connect to directly.

Additionally, you may have L3 devices where this data is already collected by an existing toolset.

Recommended device data collection per device type

Collect data from your devices semi-automatically or manually using scripts provided by AlgoSec.

Each device type has a recommended method, described in the table below.

Check Point	For details, see: Check Point FireWall-1 devices (semi-automatic). For Check Point FireWall-1 devices running on specific platforms, device data collected includes components of the Check Point file structure and the filter module's routing table. Relevant platforms include Windows, Sun, Nokia, SecurePlatform, Alteon, and Linux. Check Point devices (manual). Semi-automatic and manual data collection is supported only for Check Point device versions R77.X and below.
Cisco	For details, see Cisco routers and devices.
Juniper	For details, see Juniper devices.
Fortinet Fortigate	For details, see Fortinet Fortigate (manual).
Palo Alto Networks	For details, see Palo Alto Networks (manual).
McAfee Firewall Enterprise (Forcepoint Sidewinder)	For details, see McAfee Firewall Enterprise (Sidewinder) (manual). Note:   Support for the Forcepoint brands (Sidewinder, StoneGate) and Hillstone was deprecated in ASMS version A30.00. As of A32.20, AlgoSec no longer supports adding new Symantec Blue Coat As of A32.20 AlgoSec will no longer support adding new Symantec Blue Coat devices. Existing deployed Blue Coat devices will still be functional. devices. If you had defined these devices in an earlier version of ASMS, these devices are still available to you, with all the existing capabilities, but you cannot add new ones. We recommend backing up device data before or after upgrading and then removing these devices from AFA. Make sure to download any report zip files for the device before deleting. For more details, see View an earlier report for a specific device and the relevant AlgoPedia KB article.
Symantec Blue Coat As of A32.20 AlgoSec will no longer support adding new Symantec Blue Coat devices. Existing deployed Blue Coat devices will still be functional.	For details, see Symantec Blue Coat (manual).

Access semi-automatic data collection scripts from the AlgoSec portal. For details, see Semi-automatic data collection scripts.

Depending on your system configuration, device files can also be obtained as follows:

Use a recent AFA report

If you have a live device on another ASMS system, retrieve the full device configuration file from the latest AFA report. For example, you may want to do this when adding a device that already exists in a production system to a testing system as well. For more details, see Access log and configuration files. Tip: If your device is supported only as EA, make sure that the device support is enabled as needed in both your production and testing environments. For details, see Extend device support.

Create a JSON file manually

If you do not have another device to collect the data from, create the file manually. For details, see Static support for generic devices.

Add a static file device to AFA (UI)

This procedure describes how to add a file device to AFA from the AFA Administration area.

Do the following:

1. In AFA, access the Devices Setup page. For details, see Access the DEVICES SETUP page.

2. In the vendor and device selection page, click Device from File on the right.

3. In the Name field, enter a name for your file device.

4. Select the file you want to analyze by selecting one of the following:

   Upload new	Upload a file from your computer. Browse to and select your file. File size must not exceed 20 MB. For larger files, copy the file to the /home/afa/algosec/fwfiles directory, and use the Existing on server option. For more details, see Recommended device data collection per device type.
   Existing on server	Select a file already saved on the AFA server, in the /home/afa/algosec/fwfiles directory. Select the file you want to analyze from the dropdown list.

5. Define how AFA should acquire the device's routing information. Select one of the following:

   Automatic	Automatic. Automatically generate the device's routing information upon analysis or monitoring. Static Routing Table (URT). Take the device's routing information from a static file you provide. For more details, see Specify routing data manually.
   Static Routing Table (URT).	Take the device's routing information from a static file you provide. For more details, see Specify routing data manually.

6. Select Real-time change monitoring option to enable real-time alerting upon configuration changes. For more details, see Configure real-time monitoring.

7. Select Set user permissions to set user permissions for this device.
8. Click Finish. The new device is added to the device tree.

9. If you selected Set user permissions, the Edit users dialog box appears.

   In the list of users displayed, select one or more users to provide access to reports for this account.

   1. To select multiple users, press the CTRL button while selecting.

   2. Click OK to close the dialog.

A success message appears to confirm that the device is added. The device is now shown in the device tree in AFA, and will be included in the ALL_FIREWALLS analysis reports.

Add a static file device to AFA (CLI)

This procedure describes how to add a file device to AFA using CLI commands.

Do the following:

1. Place any collected device data files, such as in the following directory on the AFA server: home/afa/algosec/fwfiles/

   For more details, see Recommended device data collection per device type.

2. Summarize the files in a single CSV file with the following columns:

   name	The device's display name, used in the device tree and all other locations around ASMS.
   path_name	The location of the device file on the AFA machine, in the /home/afa/algosec/fwfiles directory.
   full_analysis	Determines whether to perform full analysis. To optimize performance during device analysis, enter no.

   For example:

   name	path_name	full_analysis
   MYROUTER	/home/afa/algosec/fwfiles/MyRouter.rd	no
   MYNEXUS	/home/afa/algosec/fwfiles/MyNexus.nexus	no

   Save the CSV file in the home/afa/algosec/fwfiles/ directory on the AFA server.

3. Log in to the AFA server as user afa.

4. Run import_devices -f <CSV filename> -t FILE

   where <CSV filename> is the name of the CSV file you saved in the previous step.

   For example: import_devices -f BulkL3Devices.csv -t FILE

When complete, all devices listed in the CSV file are shown in the device tree in AFA, and will be included in the ALL_FIREWALLS analysis reports.

Semi-automatic data collection scripts

The following scripts use the same commands for copying files and creating directories as are listed in the manual data collection procedures.

Firewall-1 Windows NT batch file	Download: ckp_collect.bat version: 1.23 (within a .zip archive)
Firewall-1 Sun Solaris, Linux, SecurePlatform, Nortel Alteon or Nokia IPSO	Download: ckp_collect.tar version: 1.80 (within a .tar archive)
Cisco router access-control list (IOS) collection scripts	Download: routerdump.pl utility version: 1.12 (within a .tar archive)
Juniper Netscreen	Download: nsm_log_collect.tar version: 1.3 (within a .tar archive)