topic Re: why does my stand alone Smart Event server authenticating towards the AD? in Firewall & Security Management

why does my stand alone Smart Event server authenticating towards the AD?

andersplarsson — Thu, 23 Feb 2023 09:44:53 GMT

Hi,

Got two questions I cant get my head around which is:

1. why does my stand alone Smart Event server authenticating towards the AD?

2. Changed credentials for for access towards our AD and changed the credentials in the object "LDAP-Account-Unit" that the gateways are using and of course changed the credentials in our Identity Collectors and all looks fine so far. However our SmartEvent gateway is still using the old credentials and we get failed logins in the AD from this server.

Were else are these credentials used in the Smart Event config and if only in the object "LDAP-Account-Unit" why is this not being updated. For the gateways I had to push and install policies but should not be needed or cant be done for the Smart Event host.

Regards,

Anders Larsson

Re: why does my stand alone Smart Event server authenticating towards the AD?

_Val_ — Mon, 27 Feb 2023 11:59:07 GMT

SmartEvent gateway - you probably mean server?

Perform "Install Database" on this server from your main management server and check again.

Re: why does my stand alone Smart Event server authenticating towards the AD?

the_rock — Mon, 27 Feb 2023 14:43:28 GMT

Val makes a good point, just do install database on it. Also, Im not sure what you mean by standalone smart event server...either its standalone (gateway + mgmt (mgmt part has SE enabled) OR its only mgmt that has smart even enabled OR it also could be separate dedicated smart event server ONLY.

Re: why does my stand alone Smart Event server authenticating towards the AD?

andersplarsson — Mon, 27 Feb 2023 14:56:25 GMT

This is a separate dedicated Smart Event Server.

Re: why does my stand alone Smart Event server authenticating towards the AD?

andersplarsson — Mon, 27 Feb 2023 14:57:56 GMT

Yes, server of course. the "Install Database" from main menu in SmartConsole? What exactly does that do?

Re: why does my stand alone Smart Event server authenticating towards the AD?

the_rock — Mon, 27 Feb 2023 15:01:43 GMT

K, great. To answer yuour other ?, install database is literally as if you are pushing policy to the firewall, but you are updating database on the mgmt server.

Re: why does my stand alone Smart Event server authenticating towards the AD?

_Val_ — Mon, 27 Feb 2023 15:36:27 GMT

Perform local Install DB action then.

Re: why does my stand alone Smart Event server authenticating towards the AD?

_Val_ — Mon, 27 Feb 2023 15:39:03 GMT

Although, I am a bit confused here. When you say "separate dedicated SmartEvent Server", what do you mean exactly? Is it or is it not part of your centrally managed environment? If it is a "standalone", how does it receive logs from your security system? Where SIC between this server and your FWs/log servers defined?

Re: why does my stand alone Smart Event server authenticating towards the AD?

the_rock — Mon, 27 Feb 2023 16:13:22 GMT

I could be wrong when I say this, but let @andersplarsson configm. I believe he has single mgmt, separate gw (cluster) and dedicated SE server only, so the logs are being forwarded to it from the mgmt server. Not 100% sure, but logically sounds like that might be the case.

Andy

Re: why does my stand alone Smart Event server authenticating towards the AD?

andersplarsson — Tue, 28 Feb 2023 08:56:44 GMT

What I mean with stand-alone is that its not integrated or installed on same host as the management-blade.

Regards,

/Anders

Re: why does my stand alone Smart Event server authenticating towards the AD?

andersplarsson — Tue, 28 Feb 2023 08:58:16 GMT

But I see no authentications done with faulty credentials from the Management-blade. The faulty authentication comes only from Smart Event-host.

/Anders

Re: why does my stand alone Smart Event server authenticating towards the AD?

_Val_ — Tue, 28 Feb 2023 09:48:10 GMT

So it is still managed from your SMS. Go to SmartConsole, connect to your SMS and install DB on your SmartEvent server. Let us know if it helps.

Re: why does my stand alone Smart Event server authenticating towards the AD?

_Val_ — Tue, 28 Feb 2023 09:49:48 GMT

You made auth changes through SmartConsole connected to your management server. To make changes effective on your SmartEvent server, install database on it. I think we mentioned that like 10 times already 🙂

Re: why does my stand alone Smart Event server authenticating towards the AD?

andersplarsson — Wed, 05 Apr 2023 12:59:50 GMT

Hi, forgot to reply to this. I have opened a TAC case and its still ongoing. The Made the "install database" but no change.

Regards,

Anders Larsson

Re: why does my stand alone Smart Event server authenticating towards the AD?

the_rock — Wed, 05 Apr 2023 13:01:43 GMT

Thanks for letting us know.

Andy