Integrate Routing and Remote Access Service (RRAS) EventTracker v8.x and above

Integrate Routing and Remote Access Service (RRAS) EventTracker v8.x and above Publication Date: April 18, 2017

Abstract This guide provides instructions to configure Routing and Remote Access Service (RRAS) to send the windows based events to EventTracker Enterprise. Scope The configurations detailed in this guide are consistent with EventTracker Enterprise version 8.X and later, and Microsoft Windows Server 2008 and later. Audience Routing and Remote Access Service (RRAS) users, who wish to forward windows based messages to EventTracker manager. The information contained in this document represents the current view of EventTracker. on the issues discussed as of the date of publication. Because EventTracker must respond to changing market conditions, it should not be interpreted to be a commitment on the part of EventTracker, and EventTracker cannot guarantee the accuracy of any information presented after the date of publication. This document is for informational purposes only. EventTracker MAKES NO WARRANTIES, EXPRESS OR IMPLIED, AS TO THE INFORMATION IN THIS DOCUMENT. Complying with all applicable copyright laws is the responsibility of the user. Without limiting the rights under copyright, this paper may be freely distributed without permission from EventTracker, if its content is unaltered, nothing is added to the content and credit to EventTracker is provided. EventTracker may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document. Except as expressly provided in any written license agreement from EventTracker, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property. The example companies, organizations, products, people and events depicted herein are fictitious. No association with any real company, organization, product, person or event is intended or should be inferred. 2017 EventTracker Security LLC. All rights reserved. The names of actual companies and products mentioned herein may be the trademarks of their respective owners. 1

Table of Contents Introduction to RRAS... 3 Prerequisites... 3 Configuration... 4 Forward RRAS Logs to EventTracker by deploying the Agent... 6 Import RRAS VPN logs into EventTracker Locally via DLA... 7 EventTracker Knowledge Pack (KP)... 11 Categories... 12 Alerts... 23 Import RRAS knowledge pack into EventTracker... 27 To import Category... 27 To import Alerts... 28 To import Tokens... 30 To import Flex Reports... 31 Verify RRAS Knowledge Pack in EventTracker... 32 Verify RRAS Categories... 32 Verify RRAS Alerts... 32 Verify RRAS Tokens... 34 Verify RRAS Flex Reports... 34 Sample Report- RRAS Access failure... 35 2

Introduction to RRAS RRAS stands for Routing and Remote Access Service. It is a Microsoft API and server software that makes it possible to create applications to administer the routing and remote access service capabilities of the operating system, to function as a network router. An RRAS server provides two different types of remote access connectivity: Virtual private networking - A virtual private network (VPN) is a secured, point-to-point connection across a public network, such as the Internet. A VPN client uses special TCP/IP-based protocols called tunneling protocols to make a connection to a port on a remote VPN server. The VPN server accepts the connection, authenticates the connecting user and computer, and then transfers data between the VPN client and the corporate network. Because the data traverses a public network, you must encrypt data sent over the connection to ensure privacy. Dial-up networking - In dial-up networking, a remote access client makes a dial-up telephone connection to a physical port on a remote access server by using the service of a telecommunications provider, such as analog telephone or ISDN. Dial-up networking over an analog phone or ISDN is a direct physical connection between the dial-up networking client and the dial-up networking server. You can encrypt data sent over the connection, but it is not required because the phone line is typically considered secure. Here we will monitor Virtual Private Networking and RRAS operation events. Prerequisites Prior to configuring Routing and Remote Access Service (RRAS) and EventTracker, ensure that you meet the following prerequisites: Microsoft Windows Server 2008 should be installed. Microsoft Window 7 should be installed for client purpose. Proper access permissions to make configuration changes. EventTracker v8.0 or later should be installed. Administrative access on EventTracker. 3

Configuration You must enable and configure logging on Routing and Remote Access Service (RRAS) prior to configuring EventTracker. To configure logging in RRAS 1. In the Routing and Remote Access MMC snap-in, in the navigation pane, right-click the server used, and then click Properties. If you are using Server Manager, right-click Routing and Remote Access, and then click Properties. It displays the following screen. Figure 1 2. On the Logging tab, choose one of the following options: o Log errors only - This option writes only events that indicate error conditions to the log files. Although this results in the minimum log file size, the file does not include information that can be useful in diagnosing some connectivity issues. 4

o o o o o Log errors and warnings - In addition to errors, this option also writes events that are raised when conditions exist that are outside of expected operations, but not necessarily indicative of errors. Log all events - This option writes error and warning events and all informational events to the logs. Do not log any events - This option disables all logging. Log additional Routing and Remote Access information (used for debugging) - This option instructs RRAS to include additional diagnostic information in the logs to assist with error diagnosis, connectivity issues, or performance issues. It can result in very large log files, so we recommend that you enable this option only when you are investigating a problem. Select Log errors and warnings (recommended). Figure 2 3. Click Apply, and then click the OK button to save changes. It will forward the logs to Event Viewer. 5

Forward RRAS Logs to EventTracker by deploying the Agent To configure logging in RRAS VPN Log, VPN log stores in a separate file path (i.e. C:\Windows\System32\LogFiles\IN1408.log) and RRAS operation log displays in EventViewer. 1. Open Routing and Remote Access. 2. Double-click Routing and Remote Access, and then double-click the server name on which you want to configure logging. 3. In the console tree, right-click Remote Access Logging & Policies and then select Launch NPS. 4. In left pane, click Accounting, click Change Log File properties and then select Log File tab. Figure 3 5. Change the log file Directory: and log Format: (ODBC recommended) as per requirement. 6. Click Apply and then click OK button to save the changes. 6

Import RRAS VPN logs into EventTracker Locally via DLA 1. Login to EventTracker Enterprise. 2. Click Admin dropdown, and then click Manager. 3. Click Direct Log Archiver 4. Click the Add button. Figure 4 EventTracker displays Direct Archiver Configuration window. 7

Figure 5 5. In Type dropdown, select the type as LOG. 6. Enter Configuration Name. 7. Click the Browse button to select the Log File Folder path. (OR) Type the Log File Folder path in the text box. 8. In Field Separator drop down, select Comma [Fields containing comma are wrapped in double quotes]. 8

Figure 5 9. Click the Configure button. Logfile configuration pane displays. 9

Figure 6 10. Enter Log Source, Computer Name, Computer IP, System Type. 11. Select Formatted Description option if not selected. 12. In Log File Format drop down, select Custom Log File Format. 13. In Message Fields drop down, enter ComputerName. Similarly enter following Message Fields in sequence ServiceName, Record-Date, Record-Time, Packet-Type, User-Name, Fully-Qualified-Distinguished-Name, Called-Station-ID, Calling-Station-ID, Callback-Number, Framed-IP-Address, NAS-Identifier, NAS-IP-Address, NAS-Port, Client-Vendor, Client-IP-Address, Client- Friendly-Name, Event-Timestamp, Port-Limit, NAS-Port-Type, Connect-Info, Framed-Protocol, Service-Type, Authentication-Type, Policy-Name, Reason-Code, Class, Session-Timeout, Idle-Timeout, Termination-Action, EAP-Friendly-Name, Acct-Status-Type, Acct-Delay-Time, Acct-Input-Octets, Acct-Output-Octets, Acct-Session- Id, Acct-Authentic, Acct-Session-Time, Acct-Input-Packets, Acct-Output-Packets, Acct-Terminate-Cause, Acct- Multi-Ssn-ID, Acct-Link-Count, Acct-Interim-Interval, Tunnel-Type, Tunnel-Medium-Type, Tunnel-Client-Endpt, 10

Tunnel-Server-Endpt, Acct-Tunnel-Conn, Tunnel-Pvt-Group-ID, Tunnel-Assignment-ID, Tunnel-Preference, MS-Acct-Auth-Type, MS-Acct-EAP-Type, MS-RAS-Version, MS-RAS-Vendor, MS-CHAP-Error, MS-CHAP- Domain, MS-MPPE-Encryption-Types, MS-MPPE-Encryption-Policy, Proxy-Policy-Name, Provider-Type, Provider-Name, Remote-Server-Address, MS-RAS-Client-Name, MS-RAS-Client-Version. For more details, the attribute values are mentioned in http://technet.microsoft.com/enus/library/cc771748%28v=ws.10%29.aspx. 14. Click the Save & Close button. The relevant folder is configured in the DLA folder. 15. Click the Save button. Figure 7 Now Direct Log Archiver (DLA) has been created successfully. Check the logs in search option of EventTracker EventTracker Knowledge Pack (KP) Once logs are received in to EventTracker, Alerts and reports can be configured into EventTracker. 11

The following Knowledge Packs are available in EventTracker v7.x to support Microsoft Windows Routing and Remote Access Service (RRAS) monitoring. Categories RRAS: Interface remove error - This category based report provides information related to interface remove error. RRAS: IPBOOTP configuration failure - This category based report provides information related to IPBOOTP configuration failure. RRAS: All events - This category based report provides information related to all events of RRAS. RRAS: Broadcast enabling failure - This category based report provides information related to broadcast enabling failure. RRAS: Certificate config failure - This category based report provides information related to certificate config failure. RRAS: Certificate not found - This category based report provides information related to certificate not found. RRAS: Client auto disconnected - This category based report provides information related to client auto disconnected. RRAS: Client called back - This category based report provides information related to client called back. RRAS: Client connected to RAS automatically - This category based report provides information related to client connected to RAS automatically. RRAS: Client disconnected to RAS automatically - This category based report provides information related to client disconnected to RAS automatically. RRAS: Client exceeded license limit - This category based report provides information related to client exceeded license limit. RRAS: Communication device failure - This category based report provides information related to communication device failure. RRAS: ConfigStore open failure - This category based report provides information related to ConfigStore open failure. 12

RRAS: Configured accounting provider load failed - This category based report provides information related to configured accounting provider load failed. RRAS: Configured authentication provider load failed - This category based report provides information related to configured authentication provider load failed. RRAS: Connection attempt failed - This category based report provides information related to connection attempt failed. RRAS: Connection manager initialize failed - This category based report provides information related to connection manager initialize failed. RRAS: Critical section initialization failed - This category based report provides information related to critical section initialization failed. RRAS: Demand-dial connection initiation failed - This category based report provides information related to demand-dial connection initiation failed. RRAS: Demand-dial interface not loaded - This category based report provides information related to demand-dial interface not loaded. RRAS: Demand-dial interface not registered - This category based report provides information related to demand-dial interface not registered. RRAS: DHCP RELAY FORWARD packet relay failure - This category based report provides information related to DHCP RELAY FORWARD packet relay failure. RRAS: DHCP REPLY packet relay failure - This category based report provides information related to DHCP REPLY packet relay failure. RRAS: DHCP server contact error - This category based report provides information related to DHCP server contact error. RRAS: DHCPV6 relay agent configuration failure - This category based report provides information related to DHCPV6 relay agent configuration failure. RRAS: DHCPV6 relay agent incoming msg receive failure - This category based report provides information related to DHCPV6 relay agent incoming msg receive failure. RRAS: DHCPV6 relay agent multicast enable failure - This category based report provides information related to DHCPV6 relay agent multicast enable failure. 13

RRAS: DHCPv6 relay agent packet discarded - This category based report provides information related to DHCPv6 relay agent packet discarded. RRAS: DHCPV6 relay agent socket creation failed - This category based report provides information related to DHCPV6 relay agent socket creation failed. RRAS: DHCPV6 relay event registration failed - This category based report provides information related to DHCPV6 relay event registration failed. RRAS: DHCPV6R called to start but running already - This category based report provides information related to DHCPV6R called to start but running already. RRAS: DHCPV6R critical section initialize failure - This category based report provides information related to DHCPV6R critical section initialize failure. RRAS: DHCPV6R event creation failed - This category based report provides information related to DHCPV6R event creation failed. RRAS: DHCPV6R event notification failure - This category based report provides information related to DHCPV6R event notification failure. RRAS: DHCPV6R memory allocation failure - This category based report provides information related to DHCPV6R memory allocation failure. RRAS: DHCPV6R semaphore creation failed - This category based report provides information related to DHCPV6R semaphore creation failed. RRAS: DHCPV6R started successfully - This category based report provides information related to DHCPV6R started successfully. RRAS: DHCPV6R stopped - This category based report provides information related to DHCPV6R stopped. RRAS: DHCPV6R synchronization object creation failed - This category based report provides information related to DHCPV6R synchronization object creation failed. RRAS: DHCPV6R timer queue creation failed - This category based report provides information related to DHCPV6R timer queue creation failed. RRAS: DHCPV6R windows socket initialize failure - This category based report provides information related to DHCPV6R windows socket initialize failure. RRAS: DLL component load failed - This category based report provides information related to DLL component load failed. 14

RRAS: EAP-TLS certificate not configured - This category based report provides information related to EAP-TLS certificate not configured. RRAS: EAP-TLS certificate not found - This category based report provides information related to EAP-TLS certificate not found. RRAS: Error detected - This category based report provides information related to error detected. RRAS: Event notification request failure - This category based report provides information related to event notification request failure. RRAS: Forward info hold table creation failed - This category based report provides information related to forward info hold table creation failed. RRAS: Host DLL registry key open failed - This category based report provides information related to host DLL registry key open failed. RRAS: HTTP layer initialize failure - This category based report provides information related to HTTP layer initialize failure. RRAS: IGMP event creation failure - This category based report provides information related to IGMP event creation failure. RRAS: IGMP memory allocation failure - This category based report provides information related to IGMP memory allocation failure. RRAS: IGMP multicast group join failure - This category based report provides information related to IGMP multicast group join failure. RRAS: IGMP packet discarded - This category based report provides information related to IGMP packet discarded. RRAS: IGMP proxy failed to register with MGM - This category based report provides information related to IGMP proxy failed to register with MGM. RRAS: IGMP RAS client configuration failure - This category based report provides information related to IGMP RAS client configuration failure. RRAS: IGMP router failed to register with MGM - This category based report provides information related to IGMP router failed to register with MGM. RRAS: IGMP socket operation failure - This category based report provides information related to IGMP socket operation failure. 15

RRAS: IGMP task scheduling failure - This category based report provides information related to IGMP task scheduling failure. RRAS: IGMPv2 network event enumeration failure - This category based report provides information related to IGMPv2 network event enumeration failure. RRAS: IGMPv2 packet receive error - This category based report provides information related to IGMPv2 packet receive error. RRAS: Impersonation revert error occurs - This category based report provides information related to impersonation revert error occurs. RRAS: Incoming message receive failure - This category based report provides information related to incoming message receive failure. RRAS: Interface loading error - This category based report provides information related to interface loading error. RRAS: Interface add error - This category based report provides information related to interface add error. RRAS: Interface info hold table creation failed - This category based report provides information related to interface info hold table creation failed. RRAS: Interface reachable - This category based report provides information related to interface reachable. RRAS: Interface unreachable - This category based report provides information related to interface unreachable. RRAS: IP address assigned to connected user - This category based report provides information related to IP address assigned to connected user. RRAS: IP address obtain error - This category based report provides information related to IP address obtain error. RRAS: IP address unavailable - This category based report provides information related to IP address unavailable. RRAS: IP address user disconnected - This category based report provides information related to IP address user disconnected. RRAS: IP packet filter configure error - This category based report provides information related to IP packet filter configure error. 16

RRAS: IP security apply failure - This category based report provides information related to IP security apply failure. RRAS: IPBOOTP started successfully - This category based report provides information related to IPBOOTP started successfully. RRAS: IPBOOTP stopped - This category based report provides information related to IPBOOTP stopped. RRAS: IPMGM memory allocation failure - This category based report provides information related to IPMGM memory allocation failure. RRAS: IPMGM protocol component find failure - This category based report provides information related to IPMGM protocol component find failure. RRAS: IPMGM protocol component register failed - This category based report provides information related to IPMGM protocol component register failed. RRAS: IPMGM semaphore creation failed - This category based report provides information related to IPMGM semaphore creation failed. RRAS: IPMGM started successfully - This category based report provides information related to IPMGM started successfully. RRAS: IPRIPv2 bind to IP address failed - This category based report provides information related to IPRIPv2 bind to IP address failed. RRAS: IPRIPv2 enabling failure - This category based report provides information related to IPRIPv2 enabling failure. RRAS: IPRIPv2 started successfully - This category based report provides information related to IPRIPv2 started successfully. RRAS: IPRIPv2 stopped - This category based report provides information related to IPRIPv2 stopped. RRAS: Leaky multicast local scope detected - This category based report provides information related to leaky multicast local scope detected. RRAS: Line disconnected - This category based report provides information related to line disconnected. RRAS: Link disconnected - This category based report provides information related to link disconnected. RRAS: Media access control handle failed - This category based report provides information related to media access control handle failed. 17

RRAS: Memory allocation failure - This category based report provides information related to memory allocation failure. RRAS: MGM interface ownership failed - This category based report provides information related to MGM interface ownership failed. RRAS: MGM register with RTM failure - This category based report provides information related to MGM register with RTM failure. RRAS: Multicast enable on interface failed - This category based report provides information related to multicast enable on interface failed. RRAS: Multicast scope mismatch error occurs - This category based report provides information related to multicast scope mismatch error occurs. RRAS: NAP enforcement client registration failed - This category based report provides information related to NAP enforcement client registration failed. RRAS: NAP received invalid request - This category based report provides information related to NAP received invalid request. RRAS: NapAgent request failure - This category based report provides information related to NapAgent request failure. RRAS: Network address obtain failure - This category based report provides information related to network address obtain failure. RRAS: Network event enumeration failed - This category based report provides information related to network event enumeration failed. RRAS: Network events enumeration failure - This category based report provides information related to network events enumeration failure. RRAS: Next-hop route changed by IPRIPv2 - This category based report provides information related to next-hop route changed by IPRIPv2. RRAS: Packet discarded - This category based report provides information related to packet discarded. RRAS: Packet filter disable error - This category based report provides information related to packet filter disable error. RRAS: Packet filter disabled - This category based report provides information related to packet filter disabled. 18

RRAS: Packet filter enable error - This category based report provides information related to packet filter enable error. RRAS: Packet receiving error - This category based report provides information related to packet receiving error. RRAS: Peer receive RIP messages failure - This category based report provides information related to peer receive RIP messages failure. RRAS: Port opening failure - This category based report provides information related to port opening failure. RRAS: PPP engine load failure - This category based report provides information related to PPP engine load failure. RRAS: PPP key information obtain failed - This category based report provides information related to PPP key information obtain failed. RRAS: PPP module error occurred - This category based report provides information related to PPP module error occurred. RRAS: PPP module initialize error - This category based report provides information related to PPP module initialize error. RRAS: PPP Session timeout - This category based report provides information related to PPP Session timeout. RRAS: Protocol component enabled - This category based report provides information related to protocol component enabled. RRAS: Protocol component invalid - This category based report provides information related to protocol component invalid. RRAS: RAS authentication attribute invalid - This category based report provides information related to RAS authentication attribute invalid. RRAS: RAS connected to client automatically - This category based report provides information related to RAS connected to client automatically. RRAS: RAS IP address acquired - This category based report provides information related to RAS IP address acquired. 19

RRAS: RAS IP address changed - This category based report provides information related to RAS IP address changed. RRAS: RAS server certificate retrieve failed - This category based report provides information related to RAS server certificate retrieve failed. RRAS: RAS server not accept calls - This category based report provides information when RAS server cannot accept calls. RRAS: RAS unable to renew IP address - This category based report provides information related to RAS unable to renew IP address. RRAS: RASMAN Service port enumeration failed - This category based report provides information related to RASMAN Service port enumeration failed. RRAS: RASMAN service start failed - This category based report provides information related to RASMAN service start failed. RRAS: Registry key access failure - This category based report provides information related to registry key access failure. RRAS: Registry key enumeration failure - This category based report provides information related to registry key enumeration failure. RRAS: Registry key value access failure - This category based report provides information related to registry key value access failure. RRAS: Registry key value enumeration failure - This category based report provides information related to registry key value enumeration failure. RRAS: Registry parameter section open failure - This category based report provides information related to registry parameter section open failure. RRAS: Registry value overridden - This category based report provides information related to registry value overridden. RRAS: Remote access security host registry key open failure - This category based report provides information related to remote access security host registry key open failure. RRAS: RRAS DHCP relay agent packet discarding - This category based report provides information related to RRAS DHCP relay agent packet discarding. 20

RRAS: RRAS DHCP relay agent protocol initialized - This category based report provides information related to RRAS DHCP relay agent protocol initialized. RRAS: RRAS DHCP relay failure - This category based report provides information related to RRAS DHCP relay failure. RRAS: RRAS IGMP audits - This category based report provides information related to RRAS IGMP audits. RRAS: RRAS IGMP configuration error - This category based report provides information related to RRAS IGMP configuration error. RRAS: RRAS RIP protocol initialization - This category based report provides information related to RRAS RIP protocol initialization. RRAS: RRAS RIP socket operation - This category based report provides information related to RRAS RIP socket operation. RRAS: RRAS route ignoring - This category based report provides information related to RRAS route ignoring. RRAS: RRAS RTM route addition - This category based report provides information related to RRAS RTM route addition. RRAS: RRAS start failed - This category based report provides information related to RRAS start failed. RRAS: Remote access connection manager service start failed - This category based report provides information related to remote access connection manager service start failed. RRAS: Security host module component load failure - This category based report provides information related to security host module component load failure. RRAS: Semaphore creation failed - This category based report provides information related to semaphore creation failed. RRAS: Socket creation failed - This category based report provides information related to socket creation failed. RRAS: SSTP incoming connection failure - This category based report provides information related to SSTP incoming connection failure. RRAS: SSTP memory allocation failure - This category based report provides information related to SSTP memory allocation failure. 21

RRAS: SSTP negotiation failed - This category based report provides information related to SSTP negotiation failed. RRAS: SSTP protocol request send failure - This category based report provides information related to SSTP protocol request send failure. RRAS: SSTP request send failure - This category based report provides information related to SSTP request send failure. RRAS: SSTP response receive failure - This category based report provides information related to SSTP response receive failure. RRAS: SSTP SHA1 certificate hash read failure - This category based report provides information related to SSTP SHA1 certificate hash read failure. RRAS: SSTP SHA256 certificate hash read failure - This category based report provides information related to SSTP SHA256 certificate hash read failure. RRAS: SSTP-based VPN connection terminated - This category based report provides information related to SSTP-based VPN connection terminated. RRAS: Task schedule failure - This category based report provides information related to task schedule failure. RRAS: Timer set failed for forwarding entry - This category based report provides information related to timer set failed for forwarding entry. RRAS: URL secure failure - This category based report provides information related to URL secure failure. RRAS: User authentication success - This category based report provides information related to user authentication success. RRAS: User authentication success encrypted - This category based report provides information related to user authentication success encrypted. RRAS: User authentication success strongly encrypted - This category based report provides information related to user authentication success strongly encrypted. RRAS: User callback failed - This category based report provides information related to user callback failed. RRAS: User connected and disconnected again - This category based report provides information related to user connected and disconnected again. 22

RRAS: User connection failure - This category based report provides information related to user connection failure. RRAS: User device connection established - This category based report provides information related to user device connection established. RRAS: User device disconnection occurred - This category based report provides information related to user device disconnection occurred. RRAS: User disconnected - This category based report provides information related to user disconnected. RRAS: VPN connection failure - This category based report provides information related to VPN connection failure. RRAS: VPN server route configuration failure - This category based report provides information related to VPN server route configuration failure. RRAS: Windows socket start failure - This category based report provides information related to windows socket start failure. Alerts RRAS: IPBOOTP configuration failure - This alert is generated when IPBOOTP configuration failure event occurs. RRAS: Broadcast enabling failure - This alert is generated when broadcast enabling failure event occurs. RRAS: Certificate config failure - This alert is generated when certificate config failure event occurs. RRAS: Client auto disconnected - This alert is generated when client auto disconnected event occurs. RRAS: Client disconnected to RAS automatically - This alert is generated when client disconnected to RAS automatically. RRAS: Client exceeded license limit - This alert is generated when client exceeded license limit. RRAS: Communication device failure - This alert is generated when communication device failure event occurs. RRAS: Connection attempt failed - This alert is generated when connection attempt failed event occurs. RRAS: Critical section initialization failed - This alert is generated when critical section initialization failed. 23

RRAS: Demand-dial connection initiation failed - This alert is generated when demand-dial connection initiation failed. RRAS: DHCP RELAY FORWARD packet relay failure - This alert is generated when DHCP RELAY FORWARD packet relay failure event occurs. RRAS: DHCP REPLY packet relay failure - This alert is generated when DHCP REPLY packet relay failure event occurs. RRAS: DHCPV6 relay agent configuration failure - This alert is generated when DHCPV6 relay agent configuration failure event occurs. RRAS: DHCPV6 relay agent incoming msg receive failure - This alert is generated when DHCPV6 relay agent incoming msg receive failure event occurs. RRAS: DHCPV6 relay agent multicast enable failure - This alert is generated when DHCPV6 relay agent multicast enable failure event occurs. RRAS: DHCPv6 relay agent packet discarded - This alert is generated when DHCPv6 relay agent packet discarded. RRAS: DHCPV6 relay event registration failed - This alert is generated when DHCPV6 relay event registration failed. RRAS: DHCPV6R critical section initialize failure - This alert is generated when DHCPV6R critical section initialize failure event occurs. RRAS: DHCPV6R event creation failed - This alert is generated when DHCPV6R event creation failed. RRAS: DHCPV6R event notification failure - This alert is generated when DHCPV6R event notification failure event occurs. RRAS: DHCPV6R memory allocation failure - This alert is generated when DHCPV6R memory allocation failure event occurs. RRAS: DHCPV6R semaphore creation failed - This alert is generated when DHCPV6R semaphore creation failed. RRAS: DHCPV6R stopped - This alert is generated when DHCPV6R stopped. RRAS: DHCPV6R synchronization object creation failed - This alert is generated when DHCPV6R synchronization object creation failed. 24

RRAS: DHCPV6R timer queue creation failed - This alert is generated when DHCPV6R timer queue creation failed. RRAS: DHCPV6R windows socket initialize failure - This alert is generated when DHCPV6R windows socket initialize failure event occurs. RRAS: DLL component load failed - This alert is generated when DLL component load failed. RRAS: Error detected - This alert is generated when error detected. RRAS: Event notification request failure - This alert is generated when event notification request failure event occurs. RRAS: IGMP event creation failure - This alert is generated when IGMP event creation failure event occurs. RRAS: IGMP memory allocation failure - This alert is generated when IGMP memory allocation failure event occurs. RRAS: IGMP proxy failed to register with MGM - This alert is generated when IGMP proxy failed to register with MGM. RRAS: IGMP router failed to register with MGM - This alert is generated when IGMP router failed to register with MGM. RRAS: IGMP socket operation failure - This alert is generated when IGMP socket operation failure event occurs. RRAS: IGMP task scheduling failure - This alert is generated when IGMP task scheduling failure event occurs. RRAS: IGMPv2 network event enumeration failure - This alert is generated when IGMPv2 network event enumeration failure event occurs. RRAS: Interface info hold table creation failed - This alert is generated when interface info hold table creation failed. RRAS: IP address obtain error - This alert is generated when IP address obtain error occurs. RRAS: IP address user disconnected - This alert is generated when IP address user disconnected. RRAS: IP security apply failure - This alert is generated when IP security apply failure event occurs. 25

RRAS: IPBOOTP stopped - This alert is generated when IPBOOTP stopped. RRAS: IPMGM memory allocation failure - This alert is generated when IPMGM memory allocation failure event occurs. RRAS: IPMGM semaphore creation failed - This alert is generated when IPMGM semaphore creation failed. RRAS: Line disconnected - This alert is generated when line disconnected. RRAS: Link disconnected - This alert is generated when link disconnected. RRAS: Media access control handle failed - This alert is generated when media access control handle failed. RRAS: Memory allocation failure - This alert is generated when memory allocation failure event occurs. RRAS: MGM interface ownership failed - This alert is generated when MGM interface ownership failed. RRAS: NAP enforcement client registration failed - This alert is generated when NAP enforcement client registration failed. RRAS: NapAgent request failure - This alert is generated when NapAgent request failure event occurs. RRAS: Packet filter disabled - This alert is generated when packet filter disabled. RRAS: Port opening failure - This alert is generated when port opening failure event occurs. RRAS: RAS IP address changed - This alert is generated when RAS IP address changed. RRAS: RAS unable to renew IP address - This alert is generated when RAS unable to renew IP address. RRAS: RASMAN Service port enumeration failed - This alert is generated when RASMAN Service port enumeration failed. RRAS: RASMAN service start failed - This alert is generated when RASMAN service start failed. RRAS: RRAS DHCP relay failure - This alert is generated when RRAS DHCP relay failure event occurs. RRAS: Socket creation failed - This alert is generated when socket creation failed. RRAS: User callback failed - This alert is generated when user callback failed. RRAS: User connected and disconnected again - This alert is generated when user connected and disconnected again event occurs. 26

RRAS: User connection failure - This alert is generated when user connection failure event occurs. RRAS: User device disconnection occurred - This alert is generated when user device disconnection occurred. RRAS: User disconnected - This alert is generated when user disconnected event occurs. RRAS: VPN server route configuration failure - This alert is generated when VPN server route configuration failure event occurs. RRAS: VPN logon success- This alert is generated when VPN logon connects successfully. Import RRAS knowledge pack into EventTracker 1. Launch EventTracker Control Panel. 2. Double click Export Import Utility. Click Import tab. Import Category/Alert/Tokens/ Flex Reports as given below. To import Category 1. Click Category option, and then click the browse button. 27

Figure 8 2. Locate All RRAS group of Categories.iscat file, and then click the Open button. 3. To import categories, click the Import button. EventTracker displays success message. Figure 9 4. Click OK, and then click the Close button. To import Alerts 1. Click Alert option, and then click the browse button. 28

Figure 10 2. Locate the All RRAS group of Alerts.isalt file, and then click the Open button. 3. To import alerts, click the Import button. EventTracker displays success message. 4. Click OK, and then click the Close button. Figure 11 29

To import Tokens 1. Click Token value option, and then click the browse button. Figure 12 2. Locate the All RRAS group of Tokens.istoken file, and then click the Open button. 3. To import tokens, click the Import button. EventTracker displays success message. 4. Click OK, and then click the Close button. Figure 13 30

To import Flex Reports 1. Click Report option, and then click the browse button. Figure 14 2. Locate the All RRAS group of Flex Report.issch file, and then click the Open button. 3. Click the Import button to import the scheduled reports. EventTracker displays success message. 5. Click OK, and then click the Close button. Figure 15 31

Verify RRAS Knowledge Pack in EventTracker Verify RRAS Categories 1. Logon to EventTracker Enterprise. 2. Click Admin dropdown, and then click Categories. 3. In Category Tree to view imported categories, scroll down and expand Routing and Remote Access Service (RRAS) group folder. Verify RRAS Alerts Figure 16 1. Logon to EventTracker Enterprise. 2. Click Admin dropdown, and then click Alerts. 3. In Search field, type RRAS ', and then click the Go button. Alert Management page will display all the imported Routing and Remote Access Service alerts. 32

Figure 17 4. To activate the imported alerts, select the respective checkbox in the Active column. EventTracker displays message box. 5. Click OK, and then click the Activate Now button. NOTE: Figure 18 You can select alert notification such as Beep, Email, and Message etc. For this, select the respective checkbox in the Alert management page, and then click the Activate Now button. 33

Verify RRAS Tokens 1. Logon to EventTracker Enterprise. 2. Click the Admin dropdown, and then click Parsing rule. 3. Imported RRAS tokens added in Token-Value Groups list at left side of Parsing rule tab of EventTracker Enterprise (as shown in below figure). Verify RRAS Flex Reports Figure 19 1. Logon to EventTracker Enterprise. 2. Click the Reports menu. Select Configuration. 3. In the Reports Configuration, select Defined from radio button. 4. EventTracker displays Defined page. 5. In search box enter RRAS. EventTracker displays Flex reports of RRAS. 34

Figure 20 Here you can find imported defined reports such as Routing and Remote Access Service Access failure, Access success, Accounting request & etc. report. Sample Report- RRAS Access failure Log Considered Figure 21 35