Setting up Azure Hosted Filebeat Syslog Relay with VPN

Documentation for setting up an all-in-one syslog filebeat relay server with VPN hosted on Azure.


Below are instructions for configuring multiple filebeat processes to listen for Syslog over multiple ports and sending those logs securely to a kibana service (in our case Perch).

The hardware used are Meraki firewalls configured with a Site-to-Site VPN connection directly to the server.

Follow a previous document here to do the initial SELinux setup.


This document assumes you’ve setup SELinux on Debian and are in passive mode.

VPN Server Setup

Initial Azure Configuration

  • Navigate to the Network Interface of the VM and Enable IP Forwarding.
  • Open UDP Port 500 and UDP Port 4500 in the network security group.
  • Change the private IP address from Dynamic to Static (usually 10.).
  • Create a Route Table in the resource group.
  • Add a route to match the firewall private subnet to the VM private IP address.
Client Subnet:
  • Associate the Route Table Subnet with the VM subnet.

Debian Configuration

  • Install Strongswan
sudo apt install strongswan -y
  • Set the following kernel parameters in /etc/sysctl.conf
net.ipv4.ip_forward = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
net.ipv6.conf.tun0.disable_ipv6 = 1
  • Load the sysctl file.
sudo sysctl -p /etc/sysctl.conf
  • Edit the global configuration /etc/ipsec.conf
# ipsec.conf - strongSwan IPsec configuration file
# basic configuration

config setup

conn %default

conn client1
    leftsubnet= #Azure VM Subnet #Azure VM Public IP
    leftfirewall=yes #Remote Meraki MX IP
    rightsubnet= #Remote MX Subnet
  • Generate a Pre-Shared key
head -c 24 /dev/urandom | base64
  • Set the IPSec Pre-Shared Key by editing /etc/ipsec.secrets
# VMPublicIP   MXPublicIP : PSK "YourPreSharedKey!"
  • Start the service on boot.
sudo systemctl enable strongswan-starter
  • Start the service.
sudo systemctl start strongswan-starter
  • Start the VPN.
sudo ipsec restart
  • Start the VPN tunnel
sudo ipsec up client1
  • Get the status of the tunnel
sudo ipsec status

Meraki Configuration

  • Setup a new Site-to-Site configuration.
  • Select IKEv1
  • Use an IPSEC Policy with the following settings.
Preset: Custom
Phase 1
Encryption: AES 256
Authentication: SHA1
Diffie-Hellman group: 2
Lifetime: 28800
Phase 2
Encryption: AES 256
Authentication: SHA1, MD5
PFS group: Off
Lifetime: 3600
  • Set the Private subnets to the same as the VM private subnet.
  • Set the availability to All networks or a tag specified for just the firewall.
  • Check the connection of the VPN using the following command.
sudo ipsec status

You should now see a connection established.

Additional Client VPN Configuration

  • Add a route to the route table as client1.
  • Add additional conn client2 block to /etc/ipsec.conf.
conn client2
    leftsubnet= #Azure VM Subnet #Azure VM Public IP
    leftfirewall=yes #Remote Meraki MX IP
    rightsubnet= #Remote MX Subnet
  • Generate a Pre-Shared key
head -c 24 /dev/urandom | base64
  • Set the IPSec Pre-Shared Key by editing /etc/ipsec.secrets
# VMPublicIP   MXPublicIP : PSK "YourPreSharedKey!"
  • Configure the connection on the Meraki FW.
  • Bring up the connection.
sudo ipsec restart
sudo ipsec up client2
  • Validate the connection status.
sudo ipsec status

Setup and configure Filebeat

  • Find a link to the latest version of Filebeat from Debian: Download Filebeat
  • Download the Filebeat deb on the Debian server.
curl -L -O
  • Install Filebeat.
sudo dpkg -i filebeat-8.3.1-amd64.deb
  • Enable the system module.
sudo filebeat modules enable system
  • Enable the cisco module
sudo filebeat modules enable cisco
  • Create the config directory.
sudo mkdir /etc/filebeat/configs
  • Create the client configuration for Filebeat.
  • Edit /etc/filebeat/configs/client1.yml
  • Change the syslog_port to an unused port.
		enabled: true
		path: modules.d/*.yml
		reload.enabled: true
		reload.period: 10s
    hosts: [""]
    X-Perch-Header: "Perch API Key"
    protocol: "https"
    compression_level: 5
	allow_older_versions: true
migration.6_to_7.enabled: true
- module: cisco
	enabled: true
	var.syslog_port: 42000
	var.log_level: 5
  • Create the Filebeat data directory for clients.
sudo mkdir -p /opt/filebeat/client1
  • Test the configuration
sudo filebeat -e -c /etc/filebeat/configs/client1.yml /opt/filebeat/client1
  • Create the service file
sudo vi /etc/systemd/system/filebeat-client1.service
Description=Filebeat for Client1

ExecStart=filebeat -e -c /etc/filebeat/configs/client1.yml /opt/filebeat/client1

  • Reload the daemon service
sudo systemctl daemon-reload
  • Enable and start the service
sudo systemctl enable filebeat-client1.service && sudo systemctl start filebeat-client1.service

Adding additional clients

  • Create a new client data directory.
sudo mkdir /opt/filebeat/client2
  • Copy the existing Filebeat config to a new client.
sudo cp /etc/filebeat/configs/client1.yml /etc/filebeat/configs/client2.yml
  • Edit the new config and change the syslog port and API key.
  • Copy the filebeat service file from another client.
sudo cp /etc/systemd/system/filebeat-client1.service /etc/systemd/system/filebeat-client2.service
  • Edit the new service file and specify a different config and client data directory.
  • Reload the daemon, enable the service, start the service.
sudo systemctl daemon-reload && sudo systemctl enable filebeat-client2.service && sudo systemctl start filebeat-client2.service

Send Meraki Logs

  • Navigate to Network Wide -> General -> Configure in the Meraki Dashboard.
  • Add a syslog server for the LAN IP of the log shipper server.
  • Select all logs.
  • Validate the logs are ingesting into your logging software.

Post Setup

  • Take the necessary steps in SELinux to button up the system.