Re: [ossec-list] firewall --> ossec via UDP 514 : "WARN: Message from 10.5.4.1 not allowed."

[Tony Perez, PMP]

Hi Adriel

You have the same port set on both the Agent and Server? Which server 
does this ossec.conf belong to?

Thanks

Tony

Adriel Desautels <mailto:ad_li...@netragard.com>
August 16, 2012 6:25 PM
I have the following in ossec.conf:

.
.
.
<remote>
<connection>syslog</connection>
<allowed-ips>10.5.4.1</allowed-ips>
<port>514</port>
</remote>

<remote>
<connection>secure</connection>
</remote>
.
.
.

And yet when 10.5.4.1 sends a message to the OSSEC server I get this:

WARN: Message from 10.5.4.1 not allowed.


Am I missing something?

And yes... I've restarted the server.
<<inline: compose-unknown-contact.jpg>>