9000 and 50051 error, trying to set up agent on fresh ISO install

[jebofponderworthy]

Installed UTMStack for the first time a week or two ago via the ISo. Working very nicely indeed. I want to send Watchguard firewall syslog data to it, so I need a UTMStack agent on the server. When I try to do so, it gives me the much-dreaded:

UTMStack: error: one or more of the requiered ports are closed. Please open ports 9000 and 50051.

UFW reports inactive. Suggestions?

[c3s4rfred]

Hi, @jebofponderworthy can you give more information to us? For example:

• Have you checked the connection between the Watchguard's machine and the UTMStack's Agent machine?
• What integration are you using to configure your Watchguard firewall syslog data?
• Have you follow the Agent guide according to your SO (Windows or Linux)?
• Have you follow the guide of the integration that you are using to send the logs to the agent?

Note: We don't have a specific integration to Watchguard, so you need to send the logs through any of the generic integrations: Json-Input or
Syslog.

Best regards,

[jebofponderworthy]

Having thought about it, I realize that I may have my assumptions twisting me into a knot. Here's more detail of where I was thinking:

1. I was wondering what would happen if I used the UTMStack SysLog integration with a Watchguard firewall.
2. I can tell the Watchguard, to send Syslog log entries anywhere I want.
3. The UTMStack docs said that to use the Syslog integration with a Syslog storage machine, the machine has to have the UTMStack agent on it.
4. So I was thinking, OK, I'll install the UTMStack agent on the UTMStack server and then use that server's Syslog capability.
5. But then I thought, well, possibly bad idea, don't like messing with the nice working UTMStack server. I'll put WinSysLog on one of the servers we already have the UTMStack agent on, and point the Watchguard's Syslog sender to that.
6. And then I thought, I wonder if I'm missing yet more reality in the above!

[osmontero]

You may be missing that the UTMStack agent has its own syslog server, and you can follow the Syslog integration guide to enable it. Then you can send logs directly from your Watchguard firewall to the agent.