Transcription

1 Page 1 of 6 WELCOME: MATTHEW WARREN SIGN OUT TRY OUR PRODUCTS QUOTING TOOLS ASSETS / INFO SUPPORT / SERVICES Solution ID: sk87560 How to configure R77.30 Security Gateway on Gaia OS to send FireWall logs to an external Syslog server Product: Security Gateway, ClusterXL, Cluster - 3rd party, Security Management, Multi-Domain Management / Provider-1 Version: R77.30 Last Modified: 17-Sep-2017 Solution Table of Contents: 1. Introduction 2. Prerequisites 3. Known Limitations 4. Procedure in SmartDashboard R Documentation 6. Notes 7. Related solutions 8. Revision History (1) Introduction Check Point R77.30 Security Gateway running on Gaia OS can be configured to send all its FireWall logs directly to an external Syslog server. (2) Prerequisites R77.30 Add-On must be installed on the R77.30 Security Management Server / Multi-Domain Security Management Server (and activated on the Domain Management Server). (3) Known Limitations Refer to sk Check Point R77.30 Known Limitations - "LTE" section. This feature is not available in SmartConsole R80 / R Notes: To export Check Point FireWall and Audit logs from a Security Management Server / Multi-Domain Security Management Server / Log Server to external Syslog servers, refer to sk How to export Check Point logs to a Syslog server using CPLogToSyslog. To export Check Point FireWall logs directly from a Security Gateway / Cluster Member R80.10, contact Check Point Support to get a Hotfix (Issue ID ). A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix. For faster resolution and verification, please collect CPInfo files from the Security Management Server and Security Gateways involved in the case. Show / Hide the instructions Hotfix installation instructions: 1. Hotfix has to be installed on Security Gateway / each cluster member. Note: In cluster environment, this procedure must be performed on all members of the cluster. 2. Install the hotfix using CPUSE: Make sure to install the latest build of the CPUSE Agent. Refer to sk92449: CPUSE - Gaia Software Updates (including Gaia Software Updates Agent): Section "(4-A-c)" / "(4-A-d)" - refer to import instructions for Offline procedure Section "(4-B-a)" - refer to installation instructions for Hotfixes You can also use the sk Central Deployment Tool (CDT) to install this hotfix on Security Gateways. Note: Reboot is required.

2 Page 2 of 6 Hotfix configuration instructions: 1. Connect to the command line on the Security Gateway / each cluster member. 2. Log in to the Gaia Clish. 3. Configure the external Syslog server: HostName> add syslog log-remote-address <IP_ADDRESS_of_SYSLOG_SERVER> level info HostName> save config 4. Log in to the Expert mode. 5. Add an additional configuration parameter to the Gaia Database: [Expert@HostName:0]# dbset syslog:sendfw t [Expert@HostName:0]# dbset :save 6. Install the local policy: [Expert@HostName:0]# fw fetch local (4) Procedure in SmartDashboard R Define the relevant Syslog Server(s): A. Create a new Syslog Server object: Options Option 1 i. Go to the Firewall tab at the top. Instructions ii. In the left lower pane, click on the Servers and OPSEC view. iii. Right-click on the Servers folder - go to the New menu - select Syslog... Option 2 i. Go to the Manage menu at the top - click on the Servers and OPSEC Applications... ii. Click on the New... button - select Syslog...

3 Page 3 of 6 B. Configure the Syslog Server object: In the Syslog Properties window, enter / select the relevant configuration and click on OK. Where: Field What to configure Name Enter the desired name. Comment Optional. Enter the desired description of this object. Host Select the Host Node object that represents the Syslog Server Note: If such Host Node object was not defined yet, then click on the New... button and configure the new Host Node object. Port Version 514 (this is the default value). Select either BSD Protocol, or Syslog Protocol. Syslog Protocol BSD Protocol Syslog Protocol Example of a log record <81>Jul 25 17:26: Action="accept" src=" " dst=" " proto="17" product="vpn-1 & FireWall-1" service="1147" s_port="26666" product_family="network" <81> T17:17:50Z CP-GW - Log [Fields@ Action="accept" rule="1" src=" " dst=" " proto="17" product="vpn-1 & FireWall-1" service="1052" s_port="54444" product_family="network"] C. The new Syslog Server object should appear: Options Option 1 Expected result In the Server folder, a new sub-folder Syslog should appear that contains the new Syslog Server object.

4 Page 4 of 6 Example: Option 2 In the Server and OPSEC Applications window, a new Syslog Server object should appear. Example: 2. Configure Security Gateway(s) / Cluster to send FireWall logs to the Syslog Server(s): A. Go to the Firewall tab at the top. B. In the left lower pane, click on the Network Object view. C. Expand the Check Point folder. D. Open the Security Gateway / Cluster object. E. In the left tree, click on the Logs pane. F. In the Send logs and alerts to these log servers table, click on the green [+] button - in the list, select the new Syslog Server object (that was defined on the Servers and OPSEC view). Note: It is not possible to configure a Syslog server as a Backup log server. G. Click on OK. H. Install Network Security policy on this Security Gateway / Cluster. (5) Documentation R77 versions Firewall Administration Guide - chapter "LTE" - section "Sending Check Point Logs to a Syslog Server". (6) Notes The kernel parameter fwsyslog_enable is intended for optimization of logging performance in environments that require high log rates. Do not enable this kernel parameter unless explicitly instructed by Check Point Support. Value of kernel parameter fwsyslog_enable=0 fwsyslog_enable=1 Behavior FireWall logs will be sent to Syslog Server through user space Syslog daemon (this is the default). FireWall logs will be sent Syslog Server directly from the Gaia OS kernel. (7) Related solutions

5 Page 5 of 6 sk When configuring Security Gateway to send FireWall logs to an external Syslog server, syslog object is not displayed on the Logs screen sk How to export Check Point logs to a Syslog server using CPLogToSyslog sk How to export syslog messages from Security Gateway on Gaia OS to a Log Server and view them in SmartView Tracker sk How to configure custom Syslog rules on Gaia OS based on facility and priority sk How to configure syslog daemon on SecurePlatform (8) Revision History Show / Hide revision history Date XX Sep 2017 Description "Known Limitations" section - improved the note that this feature is not available in SmartConsole R80 / R80.10: To export Check Point FireWall and Audit logs from a Management Server / Log Server to external Syslog servers, customers should refer to sk How to export Check Point logs to a Syslog server using CPLogToSyslog To export Check Point FireWall logs directly from a Security Gateway / Cluster Member R80.10, customers can contact Check Point Support to get a Hotfix (Issue ID ) Added Table of Contents 21 Aug 2017 "Introduction" section - improved the reference to sk July 2017 Added a note that this feature is planned for R80.X (as of July 2017, there is no ETA yet) 12 July 2017 "Introduction" section - improved the explanation "Introduction" section - added a note that for information about sending only specific FireWall logs to an external Syslog server, customers should refer to sk How to export Check Point logs to a Syslog server using CPLogToSyslog "Procedure in SmartDashboard R77.30" section - added another option to create a new Syslog Server object "Known Limitations" section - added a note that this feature is not available in SmartConsole R80.10 "Related solutions" section - added sk Jan 2017 Rewrote the entire article - added "Introduction", "Prerequisites", "Procedure in SmartDashboard R77.30", "Known Limitations", "Documentation", "Notes" sections 24 Oct 2016 Removed R80 from the list of relevant versions Added clarification that this feature is not currently available in R80 16 Sep 2016 Added R80 to the list of relevant versions 11 Aug 2016 Added clarification that R77.30 Add-On must be installed on the Security Management Server / Multi-Domain Security Management Server Added related sk Feb 2016 Removed all text about the possible workaround (because it is an unofficial non-supported configuration) 13 Jan 2016 Added clarification that the workaround is only for Security Gateways running Gaia R R77.20, or other OS and versions 13 Jan 2106 Added clarification that the workaround is only for Security Gateways running Gaia R R77.20, or other OS and versions Added clarification that the workaround is an unofficial non-supported configuration Removed all listed versions except R Jan 2016 Added related sk Dec 2015 Rewrote the article 07 July 2015 Added a note that R77.30 Add-On must be installed on the Security Management Server 15 June June 2015 Added a link to the relevant documentation - R77 versions Firewall Administration Guide ("LTE" chapter - "Sending Check Point Logs to a Syslog Server" section) Changed the entire article to shows that this feature is not included in the product (customers should submit Request for Enhancement)

6 Page 6 of 6 Added a note that in Check Point R77.30, the firewall syslogs can be sent directly from the Security Gateway Added a note that customers can contact Check Point Support to get a workaround 07 June 2015 Added a note about an available hotfix (Issue ID ) that allows to increase the size of syslog messages to a desired length between 1024 characters and 2048 characters Updated the list of relevant versions 28 Apr 2015 Added related sk Apr 2015 Added explanations (process substitution technique) for the alternative syntax 'while read line...', if the 'fw log -f -t -n -l...' does not work 08 Apr 2015 Added an alternative syntax 'while read line...', if the 'fw log -f -t -n -l...' does not work 07 Mar 2015 Highlighted the note that this procedure is not supported on Multi-Domain Server 13 Oct 2014 Improved instructions for configuring multiple syslog servers 01 Sep 2013 Added the 'delete syslog log-remote-address <IP_Address>' command Updated the list of relevant versions 06 Aug 2013 Improved instructions 16 Mar 2013 Improved text Added a note that this procedure is not supported on Multi-Domain Server 28 Nov 2012 First release of this article Applies To: This SK replaces sk , , , , Check Point Software Technologies Ltd. All rights reserved. Copyright Privacy Policy