Reports

System reports can be accessed via the Reports tab at the top or the Reports tab within the settings. All pre-defined reports will be listed along with any custom reports that have been created.

Reports can be searched and further defined using the time selectors and the Conditions window at the bottom of the page. The data used in the report are obtained on the Current Data window on the right.

Related Topics

• Report Viewer
• Reports

Current Time

This field displays the current time on the NG Firewall Server.

Timezone

This is the configured timezone. It is important to have the correct timezone configured to adjust for any time changesthroughout the year.

Language

This is the configured language for the NG Firewall server. The administration UI will be displayed in this language, and user-visible pages such as the quarantine and block pages. This will not change the language on certain strings like product names and all online services like the account management, help, and store pages.

Regional Formats

Force Time Sync

This button allows you to force the server time with the internet (via NTP).

Beware, if your server time is significantly in the future (hours or days), then force syncing the time may cause issues as the server's time will go backward. Threads and processes that are sleeping until a certain calendar date will now awaken at the planned time as the server time has moved significantly backward. To avoid this, reboot after forcing the time to synchronize if the time is significantly off. Also, logs and reports may behave oddly, and certain periods will occur twice.

Manual Reboot

Manual Shutdown

This button will power off the NG Firewall server.

Setup Wizard

This button allows you to re-run the Setup Wizard, which automatically launches on a new install.

Log Retention

Disk space used by logs: Shows the current usage on the disk occupied by the log files.

For each log type, number of logs to retain: Sets the number of log files to keep for each log type. Choose a low value to limit the amount of space used by logs. The minimum value is 1.

Restore from File

This allows you to upload the restored file.

The first option is typically used if you are restoring to a previous backup or recovering from a failure.

The second option is useful if you maintain a 'standard configuration' and you want to maintain this standard configuration across multiple servers. In this case, all the servers maintain the same settings, but each has unique network settings.

After selecting the Restore Options, click Browse and select the backup file you want to restore. After selecting the backup file, click Restore from File to begin the restore process.

Restore Process

After starting the restore process, the backup file is unpacked and checked.

If the backup file requires certain applications that are not currently on the NG Firewall server, it will ask to download these applications first. After downloading those applications, the restore process is run again.

If the backup file is from an unsupported version, it will show an error. It is also suggested that a backup file from the same version that the file was created with be restored. For example, if the backup file was created with NG Firewall 16.2, restoring it on an NG Firewall running 16.2 is suggested.

Typically, the restored process's only supported versions will be the current version of NG Firewall and the immediately prior major version. For example, 16.2 will restore 16.2 and 16.1 backups, not 16.0. (Trivial versions are considered identical to the minor version for restore purposes. For example, 15.1.0, 15.1.1, and 15.1.2 are all considered 15.1 when restoring backups.)

After the restore process begins, the NG Firewall processes will reboot, and you will lose connection to the server. After reconnecting to the server, the settings and configuration are restored from the backup file.

HTTP

If enabled, the http-casing HTTP processing application is running. If disabled, all special HTTP processing by the applications stops.

SMTP

If enabled, the smtp-casing SMTP processing application is running. If disabled, all special SMTP processing by the applications stops.

FTP

If enabled, the ftp-casing FTP processing application will run. If disabled, all special FTP processing by the applications stops.

Enable Shield

If checked, the Shield is enabled. If unchecked, the Shield is disabled. Warning: do not disable the Shield. Doing so may cause performance and stability issues. This checkbox is provided to allow for troubleshooting. It is never suggested that the Shield be left disabled after any troubleshooting steps.

Note that Shield only looks at new session requests; it does not influence or process traffic of existing sessions. It also does not scan bypassed sessions.

Shield Rules

Shield rules are evaluated at session creation time. The Rules documentation describes how rules are processed.

If one of the rules matches, the action from the first matching rule is applied. If no Shield rule matches, the session will be scanned.

If the session is scanned and the current session creation rate is too high, the packet will be dropped. If the current session creation rate is not too high, the current session creation rate is adjusted to account for this new session, and the session is allowed.

Reports

The Reports tab provides a view of all reports and events for all traffic handled by Shield.

Reports

This application's reports can be accessed via the Reports tab at the top or the Reports tab within the settings. All pre-defined reports will be listed along with any custom reports that have been created.

Reports can be searched and further defined using the time selectors and the Conditions window at the bottom of the page. The data used in the report can be obtained on the Current Data window on the right.

Safe List

Several applications, such as Spam Blocker, NG Firewall Filter Apps, and Phish Blocker scan SMTP messages.

Sometimes, administrators want to trust email from certain addresses to avoid scanning messages to either save resources or avoid false positives. The safe list provides a convenient location to list safe and trusted email addresses that these applications will check before scanning email.

Global Safe List

This is a global safe list that applies to all email. If an email address is listed, all mail from that address will not be scanned in Spam Blocker, NG Firewall Filter Apps, and Phish Blocker.

Emails can be specified using Glob Matcher syntax so, for example, you can safely list entire domains as "*@example.com."

Per-User Safe List

Each user/email address also has its safe list. For example, lets assume "このメールアドレスはスパムボットから保護されています。閲覧するにはJavaScriptを有効にする必要があります。" has a quarantine that they manage via the quarantine application. In the quarantine application, they can add addresses to their safe list.

For example, このメールアドレスはスパムボットから保護されています。閲覧するにはJavaScriptを有効にする必要があります。 may add "このメールアドレスはスパムボットから保護されています。閲覧するにはJavaScriptを有効にする必要があります。" to their safelist. All email from "このメールアドレスはスパムボットから保護されています。閲覧するにはJavaScriptを有効にする必要があります。" to "このメールアドレスはスパムボットから保護されています。閲覧するにはJavaScriptを有効にする必要があります。" will automatically be passed as safelisted, while email from "このメールアドレスはスパムボットから保護されています。閲覧するにはJavaScriptを有効にする必要があります。" to other users will be scanned as normal.

Per-User safe lists provide a mechanism to deal with false positives that won't effect the overall false negative rate of other user/emails.

Emails can be specified using Glob Matcher syntax so, for example, you can safely list entire domains as "*@example.com." Also, note that a user/email can add "*" to their Per-User safe list to entirely disable spam/phish scanning for emails to them.

Users can edit their own Per-User safe list in the quarantine web application. Administrators can purge users's safe lists in the administration UI.

Unique ID

The first field shows the Unique ID (UID) of the Arista server. The UID is a 16 alphanumeric code uniquely identifying this server for licensing and tracking purposes.

Never share the UID of the server.

The UID is generated automatically upon installation, and each server must have a unique UID to function properly.

Cloning servers post-installation will create two servers with identical UIDs, which will result in problems and licensing issues.

Server Information

The second field shows the build version and server information.

Build shows the version of the Arista-vm.

Kernel shows the kernel version. The other fields are used by Arista support.

Current "licensed" device count shows the current number of devices in the host table that count as "licensed" devices.

Highest "licensed" device count since reboot shows the highest value of licensed devices seen by this Arista since reboot.

Outgoing Email Server

If the Sent email is checked directly, the NG Firewall will send emails like a regular email server. It does this by looking up the MX DNS record of the recipient domain and sending the message via SMTP to that address. This generally works with no further configuration. However, many residential and even commercial ISPs block port 25 to prevent spam, and this will prevent NG Firewall from sending emails.

Email from Address

This is the "from" address of all emails sent from the NG Firewall server (excluding emails released from the quarantine).

Email Test

This sends a test email from the configured Email from Address. If your email settings are correct, the specified recipient should receive the test email within a few minutes.

Quarantine Web Application

Each day, users/emails with new emails in their quarantine will be sent a Quarantine Digest email with a link to their quarantine. Alternatively, users can request a Quarantine Digest email by accessing https://NGFW_IP:HTTPS_PORT/quarantine/.

After clicking on the Click here to access your spam quarantine link, the user can view the Quarantine web application, which allows them to manage their quarantine and their Safe List

Quarantined Messages: The Quarantine Messages tab shows the list of messages currently in the quarantine. To release messages to the inbox, simply check the message(s) and click on Release to Inbox. To release a message and automatically add the sender to your safe list, click on Release to Inbox & Add Senders to Safe List. To delete message, select the message(s) and click Delete. Note that it is not necessary to delete messages; messages will automatically be purged from quarantine after the configured time elapses.

Safe List: This tab configures your safe (trusted) email addresses. Email from the listed address will not be scanned to determine if they are spam or phishing. If a user's email is falsely determined to be spam, their email address can be added to this list to assure it does not happen again.

Forward or Receive Quarantines: Mailing lists or aliases often receive Quarantine Digests. This is annoying as all users on the list will receive the Quarantine Digest email. To avoid this, you can forward the quarantined mail to another user's quarantine, such as the email list administrator. Email will still be quarantined and released like normal, but the administrator can do it via their quarantine. Forward Quarantined Messages To configure where quarantined messages will be placed. Received Quarantined Messages From shows any other addresses from which you are receiving quarantined messages.

Quarantine Settings

User Quarantines: This shows a list of currently existing user quarantines. User quarantines are created dynamically when an email is quarantined for an email address. There is no need to delete quarantines; this will happen automatically when there are no messages. To release or purge (delete) a user's entire quarantine, select the appropriate row(s) and clickthe Purge Selected or Release Selected button at the top. To view a user's quarantine, click on the Show Detail icon on the appropriate row. This will display a window showing all the existing messages in that user's quarantine. Messages are purged (deleted) or released by clicking on the message(s) and clicking on the Purge Selected or Release Selected button at the top.

Quarantine Forwards: As discussed above, it is often desirable to have distribution lists or aliases for their quarantined email to an administrator's email quarantine so the entire list does not receive quarantine digest emails. You can view/add/delete forwards in this table.