topic Re: How to track/log GAIA portal access in Firewall and Security Management

How to track/log GAIA portal access

Joe_Kanaszka — Fri, 24 Jan 2025 14:40:50 GMT

Good morning - happy Friday!

How do you guys track/log access to the GAIA portal? Do you need to use a separate syslog server, or can I configure access/edit events to go to my Check Point logging server?

How do you tighten up access to your GAIA portals? Do you use 2FA? If so, does anyone use DUO?

Thanks guys.

Re: How to track/log GAIA portal access

the_rock — Fri, 24 Jan 2025 18:54:58 GMT

See if below helps brother.

Andy

https://community.checkpoint.com/t5/Management/MFA-for-admin-access-for-checkpoint-firewall-on-Gaia-and/td-p/170521

Re: How to track/log GAIA portal access

Joe_Kanaszka — Fri, 24 Jan 2025 19:05:35 GMT

Thanks Andy! I'll take a look at that!. Hey BTW - has a customer ever asked you to hide the Mobile Access portal so it does not show up at ALL in vuln scans? I've disabled my SSL VPN by simply unchecking the options for it in "VPN Clients" and "Mobile Access".

Now it is disabled, but a vuln scan still shows port 443 active. If I go to the external IP of my security gateway, I see my old SSL VPN banner and an error "Access denied.. This portal is not supported on this server..."

I think I found an SK to configure your gateway to only allow "internal" connections to the portal:

sk105740

Have you ever used this approach to "hide" port 443 from the outside?

I'm doing this on my DR system first before my Prod system. LOL

Thanks Andy!

Re: How to track/log GAIA portal access

the_rock — Sat, 25 Jan 2025 03:42:02 GMT

Yes I have tried it and it did work.