Installation guide

Fastvue Reporter can be deployed on Linux operating systems using Docker.

What is Docker?

Docker is a popular open platform that makes it easier to create, deploy, and run applications by using containers. Containers are lightweight and contain everything needed to run the application, so you do not need to rely on what is currently installed on the host.

For more information see https://docs.docker.com/get-started/overview/.

Why Fastvue Reporter uses Docker

Running Fastvue Reporter on Linux requires a range of pre-requisites and specific versions of those pre-requisites. Instead of managing them directly on the host, all you need to worry about is installing Docker, and using our pre-built Docker images to deploy a Container. This container has all the pre-requisites Fastvue Reporter requires and does not affect or conflict with anything you may already have installed on the host.

Getting started

The instructions below take you through loading and running a Fastvue Reporter Docker image as a container, and updating an existing container using a new image.

Deploying a new Fastvue Reporter container

The first step in deploying a new Fastvue Reporter container is to spin up a Linux-based host. We recommend Ubunto.

Configure your Linux Host

Make sure your Linux host meets our recommended requirements:

Install Open SSH

Ensure you can log in to your remote Linux server by installing Open SSH. For example, in Ubuntu:

sudo apt-get install openssh-server
sudo systemctl enable ssh
sudo systemctl start ssh

Test by logging into the system using

ssh user@server-name
# e.g.
# ssh admin@192.168.1.2

Install Docker

Install Docker on your Linux distro of choice. Please refer to Docker's docs for installations instructions: https://docs.docker.com/engine/install/

⚠️ Note: Some Linux distributions such as Ubuntu provide an option to install the Docker package as part of Ubuntu install. Do NOT do this. This installs the 'snap' version of Docker which does not work for Fastvue Reporter's requirements.

Once installed, enable Docker to run at startup using the command:

sudo systemctl enable docker

Install Docker Compose

Once Docker is installed, you now need to install Docker Compose following the instructions here: https://docs.docker.com/compose/install/

Increase the Linux host's vm.max_map_count setting

Fastvue Reporter uses Elasticsearch, which relies on memory-mapped files. On some systems, the default limit for memory mappings (vm.max_map_count) is too low, which can cause out-of-memory errors when running reports.

To avoid this, first check the current value with:

cat /proc/sys/vm/max_map_count

If the returned value is less than 262144, open /etc/sysctl.conf as root in a text editor and update the setting. To do this:

sudo nano /etc/sysctl.conf

Add the following line to the end of the file:

vm.max_map_count=262144

Save the file and exit the editor (^O, ^X). Then run:

sudo sysctl -p

Confirm the setting has saved by re-running cat /proc/sys/vm/max_map_count

Load the Fastvue Reporter Docker image

Once you have downloaded the Fastvue Reporter Docker image from the Fastvue website (create an account or log in to access the Downloads page), copy it to the Linux host and load the image in Docker.

Note: The words firewall-xyz and {product-name} in the commands and examples below should be replaced with your Fastvue Reporter's product/brand name.

Copy image to host

Copy the downloaded Docker image to your Linux host using scp.

scp <image-filename> user@ip:~

# e.g.
# scp fastvue-reporter-for-firewall-xyz.img admin@192.168.1.2:~

Load the image

ℹ️ The following commands need to be run as root. Switch to root with sudo su or add sudo before all commands.

Load the Docker image using:

docker load -i {image-filename}

# e.g.
# docker load -i fastvue-reporter-for-firewall-xyz.img
# cc967c529ced: Loading layer  65.57MB/65.57MB
#   ...
# 27f89d75f52e: Loading layer  76.31MB/76.31MB
# Loaded image: fastvue/reporter-for-firewall-xyz:latest

List your images with docker image ls to confirm that it was imported;

docker image ls
REPOSITORY                          TAG                 IMAGE ID            CREATED             SIZE
fastvue/reporter-for-firewall-xyz   latest              4328c7039e09        2 months ago        1.19 GB

Prepare a data location on the host

Next, create a folder on your machine where Fastvue Reporter's settings and data will be stored. Firewalls can generate a lot of data, so make sure you supply a location with plenty of disk space.

We recommend using /opt/fastvue/reporter-for-{product-name}. Do not use spaces, and don't store it anywhere under /home.

Create the data location using

mkdir -p /opt/fastvue/reporter-for-firewall-xyz

If you happen to be doing this on a Mac, create a folder such as
/Users/<your user profile>/Documents/Fastvue/reporter-for-firewall-xyz

Deploy the container

There are two ways to deploy the Docker container. Using Docker Compose (recommended) or Docker Run

We recommend using the Docker Compose method above as the configuration of your container is saved in a docker-compose file making it easy to update and re-deploy your container in the future when updated images are released.

Using docker compose (recommended)

First, create a directory to contain your docker-compose file. The name of this directory will be used as the name of the Docker stack that gets created when you run docker-compose so give it a meaningful name, such as fastvue-reporter-for-firewall-xyz.

mkdir fastvue-reporter-for-firewall-xyz

Inside the directory you created, create a file named docker-compose.yml

cd fastvue-reporter-for-firewall-xyz
nano docker-compose.yml

Within nano, paste in the following contents:

version: "3.3"
services:
  fastvue-reporter:
    container_name: "fastvue-reporter-for-firewall-xyz"
    image: "fastvue/reporter-for-firewall-xyz:latest"
    ports:
      - "8080:80"
      - "8443:443"
      - "50514:50514/udp"
      - "50514:50514/tcp"
    volumes:
      - /opt/fastvue/reporter-for-firewall-xyz:/data
      - /etc/timezone:/etc/timezone:ro
      - /etc/localtime:/etc/localtime:ro
    restart: always

The image should be the name of the loaded image in Docker, not the name of the docker image file you downloaded from the Fastvue website.

Also ensure /opt/fastvue/reporter-for-firewall-xyz matches the data location you created above.

Definitions:

• container_name: "fastvue-reporter-for-firewall-xyz"
A name to identify the Docker container.
• image: "fastvue/reporter-for-firewall-xyz:latest"
The name of the loaded image in Docker. This is not the name of the Docker image file you downloaded from the Fastvue website.
• 8080:80
  Map port 8080 on the host to port 80 (HTTP) inside the container.
• 8443:443
  Map port 8443 on the host to port 443 (HTTPS) inside the container.
• 50514:50514/udp
  Map port 50514 (UDP) on the host to port 50514 inside the container. This is used for receiving syslog messages.
• /opt/fastvue/reporter-for-firewall-xyz:/data
  Map the path /opt/fastvue/reporter-for-firewall-xyz on the host to /data inside the container.
• /etc/timezone:/etc/timezone:ro
/etc/localtime:/etc/localtime:ro
  Set the timezone in the Container to the same timezone as the Linux host.

Note: The following two lines map the Docker container's timezone to the Linux host's timezone. This only works on Linux hosts.

    - /etc/timezone:/etc/timezone:ro
    - /etc/localtime:/etc/localtime:ro

If you want to specify the timezone of the Docker container explicitly, or you are using Docker on Windows or MacOS, remove these two lines and replace them with

    environment:
      - TZ=Australia/Perth

Replace Australia/Perth with the appropriate timezone from the TZ Database name column from this page: https://en.wikipedia.org/wiki/List_of_tz_database_time_zones

Write Out the file and press Enter, then exit nano with Ctrl-x.

You can now deploy the container using the following command.

docker-compose up -d

The parameters have the following meanings:

• up
  Instructs docker-compose to deploy the container stack.
• -d
  Do not attach the active terminal to the container. This will cause the container to run in the background rather than taking over and being controlled by the terminal you ran the docker-compose command from. If this is not specified, you can press Ctrl-Z to detach from the container once it is running.

Using docker run

You can also deploy and run the image directly using the docker run command, specifying all the configuration options as parameters.

Deploy by mapping the Containers timezone to the host's timezone:

docker run -d \
  -p 8080:80 \
  -p 8443:443 \
  -p 50514:50514/udp \
  -v /opt/fastvue/reporter-for-firewall-xyz:/data \
	-v /etc/timezone:/etc/timezone:ro \
	-v /etc/localtime:/etc/localtime:ro \
  --restart always \
  fastvue/reporter-for-firewall-xyz:latest

Or deploy by using the TZ environment variable to set the timezone explicitly:

docker run -d \
  -p 8080:80 \
  -p 8443:443 \
  -p 50514:50514/udp \
  -v /opt/fastvue/reporter-for-firewall-xyz:/data \
  -e TZ=Australia/Perth \
  --restart always \
  fastvue/reporter-for-firewall-xyz:latest

Definitions:

• --name
  A name to identify the Docker container.
• -d
  Do not attach the active terminal to the container. This will cause the container to run in the background rather than taking over and being controlled by the terminal you ran the docker run command from.
• -p 8080:80
  Map port 8080 on the host to port 80 (HTTP) inside the container.
• -p 8443:443
  Map port 8443 on the host to port 443 (HTTPS) inside the container.
• -p 50514:50514/udp
  Map port 50514 (UDP) on the host to port 50514 inside the container. This is used for receiving syslog messages.
• -v /opt/fastvue/reporter-for-firewall-xyz:/data
  Map the path /opt/fastvue/reporter-for-firewall-xyz on the host to /data inside the container.
• -e TZ=Australia/Perth
  Set the environment variable TZ to the provided value inside the container. This will set the timezone for the container. The value specified must be one of the TZ database names at https://en.wikipedia.org/wiki/List_of_tz_database_time_zones
• -v /etc/timezone:/etc/timezone:ro
-v /etc/localtime:/etc/localtime:ro
  Set the timezone in the Container to the same timezone as the Linux host.
• --restart always
  The container will automatically start on host boot, or if the container fails.
• fastvue/reporter-for-firewall-xyz:latest
  The name of the loaded image in Docker. This is not the name of the Docker image file you downloaded from the Fastvue website.

For more docker run parameters and definitions, see https://docs.docker.com/engine/reference/commandline/run/

Check your container is running

You can check your container is running with docker ps

docker ps
CONTAINER ID   IMAGE                                      COMMAND                  CREATED         STATUS         PORTS                                                                                                                                             NAMES
75b00d26524b   fastvue/reporter-for-firewall-xyz:latest   "/bin/bash /opt/fast…"   2 minutes ago   Up 2 minutes   514/tcp, 514/udp, 0.0.0.0:50514->50514/udp, :::50514->50514/udp, 0.0.0.0:8080->80/tcp, :::8080->80/tcp, 0.0.0.0:8443->443/tcp, :::8443->443/tcp   fastvue-reporter-for-firewall-xyz

Reset Linux Kernel Connection Tracking

As Docker only creates the iptables rules for forwarding and masquerading incoming traffic to the container once the container is deployed, any existing connection state for the incoming syslog traffic will still be assuming the old rules, which means that your container will likely see the syslog traffic arriving with the source address set to the Docker network's gateway address.

To ensure the container sees syslog traffic arriving from your firewall instead of the Docker network's gateway address, you must reset the Linux kernel's connection tracking.

First install the conntrack tool on your host using your host distro's package manager. For Ubuntu, you can use:

apt install conntrack

Now reset the Linux kernel's connection tracking using:

conntrack -F

Verify Fastvue Reporter is running

Using a web browser, connect to your host on port 8080 (e.g. http://192.168.1.2:8080 ) and verify that Fastvue Reporter is running.

You can also configure Auth and SSL for the web interface by following the instructions in Apache Config. Changing this configuration does not require redeployment of the container, only a restart.

Configure Authentication and SSL in Apache (optional)

Reporter's Docker image allows for external config files to be included in the container's Apache config to add Auth and SSL configuration that persists between container runs.

These configuration files must exist under the /config/apache path in the mapped data volume.

Inside the container, the mapped data volume exists at /data so any paths that the provided config files refer to must use this as the base directory.

For example, if you store Fastvue Reporter's data at /var/fastvue/reporter-for-firewall-xyz on your host, then on the host the auth config file would be at /var/fastvue/reporter-for-firewall-xyz/config/apache/auth.conf, and the authpasswd file would exist at /var/fastvue/reporter-for-firewall-xyz/config/apache/authpasswd, but inside the container these would exist at /data/config/apache/auth.conf and /data/config/apache/authpasswd.

Configure authentication

Create a Config file in /(basepath)/config/apache/auth.conf

Where (basepath) is the Fastvue Reporter's data path on the host.

Example for Basic auth mode:

AuthType Basic
AuthName "Fastvue Reporter"
AuthUserFile /data/config/apache/authpasswd
Require valid-user

The authpasswd file contains the list of users and their hashed passwords when using Basic auth mode. This file can be created on the host and users added to it using this command.

htpasswd -c (basepath)/config/apache/authpasswd admin

Where (basepath) must be the data location on the host. The -c parameter creates the file, and must be passed only for the first user being added. The final parameter, in the example set to admin, is the username you want to create a password for. The command will ask for a password for the user.

Example for auth using LDAP integration.

AuthType Basic
AuthName "Fastvue Reporter"
AuthBasicProvider ldap
AuthLDAPURL "ldap://dc-server.domain.local:389/DC=domain,DC=local?sAMAccountName?sub?(objectClass=*)"
AuthLDAPBindDN "administrator@domain.local"
AuthLDAPBindPassword "(password)"
Require valid-user

The LDAP URL would be specific to your system configuration, but the ?sAMAccountName?sub?(objectClass=*) part is required. The AuthLDAPBindBN also must either be the FQDN of a user authorised to make auth queries, or the username in UPN syntax (user@domain).

Private Report Sharing

Allowing anonymous or alternate auth access to /_ and /p for private report sharing is supported through a secondary config file named authshared.conf. The directives in this file will only apply to the /_ and /p directories.

Example authshared.conf allowing full anonymous access to /_ and /p regardless of the site root's auth configuration;

Require all granted

If authshared.conf is not provided, the /_ and /p directories will share the same auth config as the site root, and if the auth.conf file is not provided, the site root will default to Require all granted allowing anybody to access the site.

Configure SSL

Config file at /config/apache/ssl.conf

SSLEngine	On
SSLCertificateFile	/data/config/apache/sslcert.pem
SSLCertificateKeyFile	/data/config/apache/sslprivate.key

The certificate file sslcert.pem and the key file sslprivate.key can be self-signed or provided separately.

To create a self-signed certificate, the following command can be used;

openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout (basepath)/config/apache/sslprivate.key -out (basepath)/config/apache/sslcert.pem

Where (basepath) must be the data location on the host. This command will ask for details for the certificate which the user must enter.

Updating an existing container

When Fastvue releases new updates, you need to update your existing container and image.

Stop and remove the existing container

To do this, first find your container's ID or Name using docker ps and then stop and remove it, using docker stop <container-name> and docker rm <container-name>

docker ps
CONTAINER ID        IMAGE                       COMMAND                   CREATED             STATUS                       PORTS                                                                                     NAMES
480948a8931a        67cc5f1b1d11                "/bin/bash/opt/fastvue"   9 days ago          Up 4 seconds                 514/tcp, 514/udp, 0.0.0.0:50514->50514/udp, 0.0.0.0:8080->80/tcp, 0.0.0.0:8443->443/tcp   fastvue-reporter-for-firewall-xyz

docker stop fastvue-reporter-for-firewall-xyz
fastvue-reporter-for-firewall-xyz

docker rm fastvue-reporter-for-firewall-xyz
fastvue-reporter-for-firewall-xyz

Stop and remove the existing image

Once the container has been removed, find the ID of the existing loaded Docker image using docker image ls, then remove it, using docker image rm <image-id>

docker image ls
REPOSITORY                          TAG       IMAGE ID       CREATED         SIZE
fastvue/reporter-for-firewall-xyz   latest    27d03835094b   8 days ago      1.25GB

docker image rm 27d03835094b

⚠️ If you don't remove your existing image before the next step, docker will rename your old/existing image to an empty string. This can then be removed with docker image rm <id>

Load and deploy the new image

Once the Docker container and image has been removed, replace your image file with the new one downloaded from the Fastvue website, then follow the steps above load the image and deploy your container.

Access Microsoft Forefront TMG's log files

The way Fastvue Reporter imports data from your TMG Server varies depending on the Forefront TMG's logging options.

In Forefront TMG, go to Logs & Reports and select Configure Web Proxy Logging on the right hand side. In this dialog you'll see there are three logging options:

• SQL Server Express database
• Microsoft SQL Server database
• File logging

The SQL Server Express database and File Logging options both store the log files on the TMG server. To access these logs, you need to use the Fastvue Arbiter setup process below.

For Microsoft SQL Server databases, you can connect the Fastvue Reporter server directly to the external SQL server, and the Fastvue Arbiter is not required. Jump straight adding a Source in Fastvue Reporter below.

Fastvue Arbiter setup for TMG's local logs

The Fastvue Arbiter is a light-weight application that you install on your TMG server. It connects to Forefront TMG’s local logs and sends the data securely to the Fastvue TMG Reporter server on port 49361.

The Fastvue Arbiter does not need to be installed if Forefront TMG is logging to a remote SQL server. You can connect Fastvue Reporter directly to the remove SQL Server.
If you are using File Logging, make sure the W3C Text option is selected. Native *.iis text logs are not supported.

To install the Fastvue Arbiter, download and run the Windows installer for Fastvue TMG Reporter onto your TMG server, and select the section option. Proceed through installation wizard using the default options.

Add Access Rule

Once the Fastvue Arbiter has been installed, you need to create an Access Rule on the TMG server to allow communication between the Fastvue Arbiter and TMG Reporter
The rule should Allow TCP 49361 Outbound from the TMG Reporter server to Localhost for All Users.

To do this:

1. Open Forefront TMG’s Management Console and select Firewall Policy on the left hand side
2. Click Create Access Rule on the right hand side. This launches the Access Rule wizard.
3. Give the access rule the name Fastvue and select Allow as the Rule Action.
4. Select Selected Protocols from the drop down list and click Add…
5. Click New… | Protocol on the tool bar to launch the new Protocol Definition Wizard.
6. Call the Protocol Fastvue. On the Primary Connection Information page click New… and select:
   Protocol Type: TCP
   Direction: Outbound
   From: 49361
   To: 49361
   Click OK and click Next.
7. Select No to Use secondary connections and click Finish to add the protocol
8. Expand the User-Defined folder, select the new Fastvue protocol and click Add.
9. Back on the Access Rule Wizard, click Next.
10. On the Access Rule Sources page click Add…
11. Click New… | Computer on the toolbar and enter the name TMG Reporter and enter the IP address of the TMG Reporter Server. Click OK.
12. Expand the Computers folder, select the newly added TMG Reporter computer and click Add.
13. Back on the Access Rule Wizard, click Next. On the Access Rule Destinations wizard, click Add…
14. Expand the Networks folder and select Localhost then click Add.
15. Back on the Access Rule Wizard, click Next. On the User Sets page, leave ‘All Users’ in the list and click Next.
16. Click Finish to add the rule.

The Fastvue Arbiter should now be sending log data to the Fastvue Reporter server.

Add a Source

In your web browser browse to the Fastvue TMG Reporter site you installed in step 1 (e.g.http://10.1.1.1/tmgreporter). If you have not yet configured a source, you will be directed to the Start page. You can add your first TMG Server as a Source on this page, or in Settings | Sources.

Add a Fastvue Arbiter source

If you're using the Fastvue Arbiter to receive Forefront TMG's local log files, simply add the IP address of your TMG server and click Add Source.

Add a SQL Server source

If Forefront TMG is logging to a remote SQL Database, go to Settings | Sources and click Add Source. Use the ‘SQL Server’ option to enter the credentials required to connect to your SQL Server, and select the database and tables that TMG is logging to.

Note: If you are using Windows Authentication, make sure the machine account (domain\machine$) of the Fastvue TMG Reporter server has read access to the database.

Tip: If you have more than one Web Proxy or Firewall table, you can enter wildcards such as *Web* to select MyWebProxy1, MyWebProxy2 etc.  Or just enter * and TMG Reporter will check every table in the Database.

Enable/Disable TMG Servers

When importing data from a remote SQL Server, there is an additional Manage Servers tab on your new SQL Source. Click this tab to view a list of all the TMG Servers found to be logging to the database. You can enable and disable importing from these servers as required.

Note: TMG Reporter’s licensing is based on the number of TMG Servers you need to monitor. Note the number of servers in this list before purchasing.

Enjoy

Now you can try out the many features of Fastvue Reporter!