Getting Data In

How to deploy Check Point OPSEC LEA on several heavy fowarder servers?

sassens1
Path Finder

Hello,

I have a couple of heavy forwaders running but only one with Checkpoint LEA 3.1 TA installed.
Thus in case of failover I'll loose all log grabbing from my Checkpoint CMA's.
But if I install the TA on each heavy forwarder with the same config I'll have multiple checkpoint logs entries.

How can setup a resilient installation of the opsec-lea TA accross mutliple forwarders?
Note: I plan to updgrade to v4.1 but I don't see any difference in the log collecting process.

0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi,

Short answer based on my experience with OPSEC LEA 3.1: it's evil.

Even if you have the TA deployed on each HF with the same config, how do you sync them all so that they all know where to start to read from and you don't end up with duplicates or gaps?

Your best bet as far as I can tell would be to use Virtual Machines for that heavy forwarder and rely on whichever resiliency your VM team can provide: VM snapshots, backups, etc. Keep in mind your logs are stored in your CheckPoint CMAs for quite some time (depending on your configuration) so if a VM is unavailable for 1-2 hours it shouldn't be a massive disaster.

I don't know if v4.1 solves this problem as I'm not planning to upgrade any time soon.

Sorry it's probably not the answer you were looking. Maybe others can share their own experiences and help you a bit more.

Thanks,
J

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...