Use https://seceonhelp.freshdesk.com/support/login to access updated Knowledge Base Articles, Submit Technical Support Tickets and Review Status of submitted support tickets.

TP Link Device integration

Owned by Customer Success & Engineering (Unlicensed)
Last updated: Jan 29, 2023
2 min read

Overview

We are providing you with the steps to integrate your TP-Link device with Seceon aiSIEM. So you can have Comprehensive visibility and Proactive Threat Detection in your Environment. There will be a log transfer between your firewall to APE(Analytics and Policy Engine) via CCE (Collection and Control Engine ). In this document, we are guiding you through the steps for flow forwarding.

Steps of Configuration

Step 1. Login to TP-Link device as an administrator.

Step 2. Choose the menu MAINTENANCE > sFlow > sFlow Collector to load the following page.

Figure 2-2Configuring the sFlow Collector

 

Step 3.Follow these steps to configure the sFlow Collector:

1)Select a Collector and configure the relevant parameters.

Collector ID

Displays the Collector ID. The switch supports 4 collectors at most.

Description

Give the collector a description for identification with 16 characters at most.

Collector IP

Enter the IP address of the host that runs the sFlow Collector.

Collector Port

Specify the UDP port number for the sFlow collector. The default is port 6343.

Maximum Datagram Size

Specify the maximum number of data bytes that can be sent in a single sample datagram. Valid values are from 300 to 1400 bytes and the default is 300 bytes.

Timeout (s)

Specify the aging time after which the sFlow Collector will become invalid. Valid values are from 0 to 2000000 seconds; the default is 0, which means the collector is always valid.

Lifetime (s)

Displays the remaining time of the collector. Lifetime counts down from Timeout.

Click Apply.

 

Refer Link- configuring_sflow

Verification Of Configuration

Verification can be done either from CCE Server or from UI.

Using UI

STEP 1: Log in to UI >> SYSTEM

STEP 2: >> LOGS AND FLOWS COLLECTION STATUS.

STEP 3: >>Inside SOURCE DEVICE IP, IP will reflect.

Using CCE Server

“sudo tcpdump -i any host 514 and host <IP address> -AAA” command should be running on the CCE server to check whether or not we are getting logs.

Seceon Inc. All rights reserved. https://www.seceon.com