topic Re: R80.10 log server question in Firewall and Security Management

R80.10 log server question

Vincent_Bacher — Tue, 06 Feb 2018 19:42:57 GMT

Hello Mates,

in R80.10 I am researching how to separate a policy management and log server into two several vmware hosts and manage/view both using one smartconsone session. In R77.30 I just configured the gateway to send logs to the log server and connected smartvew tracker to this server.

But in R80.10 I am not sure how to see the logs from the dedicated log server when connected to the policy management server with SmartConsole.

Maybe it's very easy and simple but I did not find a howto or sk about that scenario.

Any hint is appreciated.

Hopefully it's clear what I want to achieve

Cheers

Vincent

Re: R80.10 log server question

Vladimir — Tue, 06 Feb 2018 23:48:36 GMT

Vincent,

1. Install GAIA as Open Server from ISO on sufficiently large virtual HDD. Configure partitions to reflect anticipated utilization, when prompted.

2. During First Time Configuration Wizard, select "Security Management" only, and then "Log Server".

3. Create a Check Point host:

4. Go to its "Management" tab and select your logging functions:

4. Enter its Hostname and IP and initialize SIC:

5. Once SIC is initialized, verify that the gateway you are logging from is listed in host's "Logs" section and enable Indexing (this requires ample space on allocated virtual HDD and preferably four vCPU cores).

6. Open your gateway's properties and verify that the log server is the one selected there:

Cheers,

Vladimir

Re: R80.10 log server question

Vincent_Bacher — Wed, 07 Feb 2018 07:29:01 GMT

Hello Vladimir,

great, thanks a lot. This is what i had in mind as well.

And the "Logs & Monitor" section of the SmartConsole will then automatically Display logs from this dedicated Logserver, right? I want to disable logging on the Network Policy Management Server itself.

Fine, so this won't be very difficult

Cheers

Vincent

Re: R80.10 log server question

G_W_Albrecht — Wed, 07 Feb 2018 11:47:13 GMT

There is also the need to license this new deployment to make it work. I think you will have to contact your sales rep for a log server management container and attach the Logging Blade there (or let Account Services do that).

Re: R80.10 log server question

Vincent_Bacher — Wed, 07 Feb 2018 11:58:04 GMT

I think there is already a license for a secondary Management, so logging should be covered. Thanks

Re: R80.10 log server question

G_W_Albrecht — Wed, 07 Feb 2018 12:04:54 GMT

Very good, then you are licensed already and only have to deal with the tech side 😉

Re: R80.10 log server question

Vincent_Bacher — Wed, 07 Feb 2018 12:13:46 GMT

Cool. Licensing stuff is annoying

Re: R80.10 log server question

G_W_Albrecht — Wed, 07 Feb 2018 12:16:56 GMT

Quite right you are - but still, these licenses do pay my cost of living, so they can not be bad altogether 😉

Re: R80.10 log server question

Vladimir — Wed, 07 Feb 2018 13:27:54 GMT

I believe that the discovery of the log server(s) by SmartConsole is happening in the background and the management server you are connecting to is aware of distributed functionality by means of SIC. Therefore logging and monitoring should be directed to additional log servers, SmartEvent servers and Log Correlation Units.

Guenther, can you verify this supposition?

Re: R80.10 log server question

G_W_Albrecht — Wed, 07 Feb 2018 14:13:34 GMT

I would say that the Log Server(s), Smart Event Server and Log Correlation Units are defined in Dashboard. In SMS object, you see which GWs are currently logging to this SMS. Im GW object, you find the other options like local logging.

Re: R80.10 log server question

Alejandro_Mont1 — Wed, 07 Feb 2018 15:51:23 GMT

When you launch SmartConsole to the management server and click on the Logs pane, by default logs from all devices with the Logging blade enabled will be displayed, no additional action is necessary. On the right side there will be an option to see logs only from specific log servers if you wanted to drill down. Note that this option will not appear unless you have more than 1 device with the logging blade enabled in your environment.

In my experience there can occasionally be an error stating a log server is disconnected even though all devices are up in environments with multiple servers. (sk119912).

Re: R80.10 log server question

Vincent_Bacher — Wed, 07 Feb 2018 16:04:08 GMT

This is exactly what I wanted do be clarified.

Thank you very much Alejandro. *thumpsup*

Re: R80.10 log server question

Vincent_Bacher — Wed, 07 Feb 2018 16:27:55 GMT

And there will be just one log server. Ahe policy management server log server will be disabled.

Re: R80.10 log server question

Alejandro_Mont1 — Wed, 07 Feb 2018 20:21:37 GMT

I'd recommend leave the logging blade enabled if possible even though it won't be in use. Even if your firewalls aren't logging to it there are some logging activities written (policy install history, dashboard login/logouts) on the management server that are important. You also have the option to configure the gateways to log back to the management server in case the log server goes down by keeping the blade enabled. I do know that log indexing needs to stay on (sk119335). It wouldn't surprise me that it would be a requirement to keep the blade enabled on a management server but you'd have to look through admin guides to confirm. Just building my case here that I wouldn't disable the blade if possible, I've seen that "Log server is disconnected" error a million times (search support center) and I try not to tinker with what works:)

Re: R80.10 log server question

Vincent_Bacher — Wed, 07 Feb 2018 20:28:31 GMT

Good point, you're right. I think it will be best to let it enabled and configure the gateways to log to mgt in case of log server outage.

Thanks for pointing me to that.

Re: R80.10 log server question

AlekseiShelepov — Wed, 07 Feb 2018 20:44:03 GMT

I did the following setup for our environment, where we have two MDS in different datacenters. Logs are sent to both servers all the time. So in case of any outage/unavailability of the primary server we would have all logs on the secondary, but not only from the time when firewalls discovered that the main server is not reachable.

As it is R77.30 version, I enabled log indexing (SmartLog) only on the secondary server, to save some hardware resources on the primary. If I choose to open SmartLog from a drop-down menu at the top of SmartConsole it will connect me to the secondary server right away.

And I totally support you with the very good option for Vincent Bacher to leave logging blade enabled on the main management server, and use at as a backup option in case when the separate log server is unavailable.

Re: R80.10 log server question

Vladimir — Fri, 21 Jun 2019 09:15:30 GMT

Check out pages 3-7 in this document: https://community.checkpoint.com/docs/DOC-2333 where I have outlined the multi-site and multi-server architecture, you may find it handy even if it does not match your environment.

Re: R80.10 log server question

Vincent_Bacher — Wed, 07 Feb 2018 20:53:04 GMT

Thanks a lot. Will have a look at the document tomorrow in my office. Using my mobile I get

Unauthorized

Re: R80.10 log server question

Vladimir — Fri, 21 Jun 2019 09:15:32 GMT

Sorry: it was stuck in review queue since October 2017

I have just re-posted it here: https://community.checkpoint.com/docs/DOC-2333-diagrams-and-tablespdf

Re: R80.10 log server question

Vincent_Bacher — Wed, 07 Feb 2018 21:27:48 GMT