Getting Data In

Checkpoint LEA and SSL authentication

cyrillefranchet
Explorer

Hi all,

Does anyone try to use FWN1 auth method successfully instead of SSL one?

I'm asking because it could be complicated to stop ChekPoint Manager in a production environment to modify the fwopsec.conf file.

Thanks for your help.

Cheers,

Cyrille

Tags (3)
0 Karma
1 Solution

cyrillefranchet
Explorer

Ok to have this working , on Splunk forwarder you need to retrieve the key by executing the following command.

opsec_putkey -port 18184 < Source IP address of checkpoint box >

You should get the authkeys.C file. Copy this file in the $SPLUNK_HOME/etc/apps/lea-loggrabber-splunk/bin/ directory.

Modify lea.conf file to change "lea_server auth_type ssl_opsec" to "lea_server auth_type auth_opsec".

Restart the Splunk forwarder. Now , you should receive events from CheckPoint.

Cyrille.

View solution in original post

cyrillefranchet
Explorer

Ok to have this working , on Splunk forwarder you need to retrieve the key by executing the following command.

opsec_putkey -port 18184 < Source IP address of checkpoint box >

You should get the authkeys.C file. Copy this file in the $SPLUNK_HOME/etc/apps/lea-loggrabber-splunk/bin/ directory.

Modify lea.conf file to change "lea_server auth_type ssl_opsec" to "lea_server auth_type auth_opsec".

Restart the Splunk forwarder. Now , you should receive events from CheckPoint.

Cyrille.

araitz
Splunk Employee
Splunk Employee

Note this is valid for pre-2.0.0 versions of Splunk OPSEC LEA integration.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...