Firewalla - Wazuh Agent

Follow

Techie

• October 13, 2023 21:02

Hello,

I am having an issue, I had set up a Wazuh SIEM for my home lab a couple of months ago, I then bought a Firewalla Purple and have that setup etc and done a few other projects.

 

I have come back to my Wazuh project and noticed that the agents haven't been communicating with the Wazuh Server since I installed FW Purple, that can't be a coincidence...

Is there something I need to do in order to get communication back up, I would assume some port rule is blocking Wazuh / Agents?

Any help with this is much appreciated.

0

• 

  Firewalla

  • October 13, 2023 21:24

  Is the agent and server on the same network? if you know the IP address of the Wzauh server, can you ping it? if you can, then there is no block. If you can't,  and it can be ping'ed from other places, then tap on devices, find the device running agent, then turn on emergency access.

  If emergency access works, then you have a rule blocking the server. 

  0

  Comment actions Permalink
• 

  Techie

  • October 14, 2023 15:04

  Hi,

  Ping the Server = Yes, tried yesterday before posting, and tried again just now.

  I don't know then what could be causing the issue, as the Wazuh Server didn't change anything, Network wise Firewalla was the only change and so that's where I thought/think the issue is coming from.

  0

  Comment actions Permalink
• 

  Firewalla

  • October 14, 2023 16:27

  If you can ping the server, the issue is likely somewhere else. 

  Does the server connect back to your home? if it is, then you may need look at port forward. 

  0

  Comment actions Permalink

Please sign in to leave a comment.