topic Re: LEA port not listening in Firewall and Security Management

LEA port not listening

Justin_Hickey — Wed, 17 Jan 2018 00:15:42 GMT

I have a Checkpoint Log Server that is the center point of logs for 6 firewalls. I've setup a LEA connection to that server from a SOC log collection appliance, TCP 18186, which works fine, and another one to a QRadar SIEM 18185 which doesn't work at all. I've restarted services and rebooted, the LogServer just wont listen on the port. I've confirmed this with netstat. Attached is the fwopsec file from the Checkpoint logs server. Any help is appreciated.

Thanks,

Justin

Re: LEA port not listening

PhoneBoy — Wed, 17 Jan 2018 05:28:26 GMT

My question is: why do you need to use multiple LEA ports?

Particularly when they are both unauthenticated?

The only place I've seen two different LEA ports used is when one of them is authenticated, the other is not.

Something like in this SK: Configuring a Log Server R76 and lower to work with both SmartEvent component and an OPSEC LEA server

I don't believe you can do two unauthenticated LEA ports.

https://community.checkpoint.com/people/bbent09791668-5ef8-377b-845e-545aff695211‌?

Re: LEA port not listening

Justin_Hickey — Wed, 17 Jan 2018 12:36:57 GMT

Thanks for the reply Dameon. I didn't realize that I could point two log sources at the same LEA instance. When you say "unauthenticated", I mean, they do exchange certificates and SIC information. Would you say they are still unauthenticated in that instance ?

Thanks again,

Justin

Re: LEA port not listening

Ni_c — Wed, 17 Jan 2018 16:17:28 GMT

We had a similar issue long back for R80 management. At that time the issue was fixed after restatting the QRadar services only after make sure of the authentication type and port on both QRadar and log server are same.

Re: LEA port not listening

PhoneBoy — Wed, 17 Jan 2018 16:52:06 GMT

I mean unauthenticated.

This is based on what it says in sk89620 and the screenshot of your fwopsec.conf says.

You probably want to change the line to auth_port instead of just port if you want SIC authentication

Note that LEA has been multi-threaded (and able to support multiple endpoints connecting) since R77.

Re: LEA port not listening

DeletedUser — Wed, 17 Jan 2018 17:15:11 GMT

What Dameon said 🙂 Would just add that if both do SIC, then there's no need for the fwopsec.conf edits. Use the defaults and have them connect on the same port 18184. Will simplify things when you do an upgrade.

Re: LEA port not listening

Justin_Hickey — Wed, 17 Jan 2018 19:46:18 GMT

Thanks for the many responses. Couldn't get it to work on 18184. I did a tcpdump and currently traffic between log and management server exist on that port. I got it work with 18186 but most of the pertinent fields come across as *** Confidential *** . I'm assuming perhaps checkpoint doesn't like to send this info across the wire in the clear ?

Going to try 18184 again.

Re: LEA port not listening

Justin_Hickey — Wed, 17 Jan 2018 20:10:26 GMT

Second try worked with 18184, going to change my other log source as well. Thanks for all the help. I haven't worked on Checkpoints for 10+ years back when they were on Nokias so I am more than a little rusty.

This guide was helpful on the QRADAR side.

https://www.ibm.com/support/knowledgecenter/SS42VS_DSM/t_DSM_guide_Checkpoint_firewall1_OPSECLEA.html#t_dsm_guide_checkpoint_firewall1_opseclea

Re: LEA port not listening

PhoneBoy — Wed, 17 Jan 2018 20:25:16 GMT

Great to hear

I still have a few Nokia boxes at my house from back in the days when I worked there.