https://community.checkpoint.com/t5/Firewall-and-Security-Management/Security-gateway-sending-logs-over-internet-instead-of-MPLS/m-p/212792#M40429 <P>Hi we currently have set of 2 clusters and one management server. One cluster in datacenter (6000 series) and one for on site (5000 series). The management server is located in datacenter. Up until now the site had it's own public ip address.&nbsp;</P><P>We changed the design and currently use mpls uplink as default gateway. We changed the default gateway and management works. We can push new rules and we see gateways are up and utilized.</P><P>&nbsp;</P><P>However, we ran into an issue with logs. We aren't receiving logs from security gateways on site. The gateways are trying to send logs over the internet instead of using private address connection. I can see attempts to send UDP packets with port 257 from our ISP provider public segment to the public ip of our gateways in datacenter. Before trying to set up rules allowing the communication&nbsp; we would like to try to make the gateways communicate over MPLS instead.</P><P>Is there any way to tell the gateway that there is private address to which it can send logs?</P><P>I can reach port 257 from the cli of the gateway to the private management server ip.</P><P>&nbsp;</P><P>We are still running R80.40..</P> Tue, 30 Apr 2024 17:04:59 GMT Denis_Ruzicka 2024-04-30T17:04:59Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Security-gateway-sending-logs-over-internet-instead-of-MPLS/m-p/212792#M40429 <P>Hi we currently have set of 2 clusters and one management server. One cluster in datacenter (6000 series) and one for on site (5000 series). The management server is located in datacenter. Up until now the site had it's own public ip address.&nbsp;</P><P>We changed the design and currently use mpls uplink as default gateway. We changed the default gateway and management works. We can push new rules and we see gateways are up and utilized.</P><P>&nbsp;</P><P>However, we ran into an issue with logs. We aren't receiving logs from security gateways on site. The gateways are trying to send logs over the internet instead of using private address connection. I can see attempts to send UDP packets with port 257 from our ISP provider public segment to the public ip of our gateways in datacenter. Before trying to set up rules allowing the communication&nbsp; we would like to try to make the gateways communicate over MPLS instead.</P><P>Is there any way to tell the gateway that there is private address to which it can send logs?</P><P>I can reach port 257 from the cli of the gateway to the private management server ip.</P><P>&nbsp;</P><P>We are still running R80.40..</P> Tue, 30 Apr 2024 17:04:59 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Security-gateway-sending-logs-over-internet-instead-of-MPLS/m-p/212792#M40429 Denis_Ruzicka 2024-04-30T17:04:59Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Security-gateway-sending-logs-over-internet-instead-of-MPLS/m-p/212810#M40437 <P>It's actually TCP 257 that is used for logs.<BR />The gateways will use whatever is configured in the management object (the "main IP"), the communication to this will be routed per the device routing configuration.<BR />Have you confirmed the routing for this IP address is correct?</P> <P>This may also be relevant:&nbsp;<A href="https://support.checkpoint.com/results/sk/sk112162" target="_blank">https://support.checkpoint.com/results/sk/sk112162</A>&nbsp;</P> Tue, 30 Apr 2024 20:26:18 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Security-gateway-sending-logs-over-internet-instead-of-MPLS/m-p/212810#M40437 PhoneBoy 2024-04-30T20:26:18Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Security-gateway-sending-logs-over-internet-instead-of-MPLS/m-p/213539#M40697 <P>Is the automatic Nat still configured on mgmt object? Did you change main ip of the members with mpls net ips?</P> Tue, 07 May 2024 21:58:24 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Security-gateway-sending-logs-over-internet-instead-of-MPLS/m-p/213539#M40697 CheckPointerXL 2024-05-07T21:58:24Z