topic Re: Export Log's Harmony Endpoint in Endpoint

Export Log's Harmony Endpoint

itguerreiro — Fri, 03 Mar 2023 19:59:01 GMT

Dear all, I have a doubt about the log send configuration.

The documentation informs that it is possible to use ports 514 and 6514 for the TCP and UDP protocols, but when I choose port 514/UDP in the manager, only port 6514 is available via UDP.

Is it possible or not to use port 514/UDP?

https://downloads.checkpoint.com/fileserver/SOURCE/direct/ID/110134/FILE/CP_Harmony_Endpoint_AdminGuide.pdf

This information is on page 274.

Thanks,

Re: Export Log's Harmony Endpoint

PhoneBoy — Sat, 04 Mar 2023 00:56:37 GMT

What version/JHF is this or are you managing from Infinity Portal?

Re: Export Log's Harmony Endpoint

_Val_ — Mon, 06 Mar 2023 09:25:35 GMT

514 UDP is for syslog. Are you trying to use syslog to export logs? It makes much more sense to use the proprietary TLS protected protocols.

Also, why would you export the logs TO your management server? Please elaborate on what you are trying to achieve.

Re: Export Log's Harmony Endpoint

Chris_Atkinson — Mon, 06 Mar 2023 11:31:37 GMT

On-prem management/log servers have an "accept syslog" option (sk102995 - Part 2) but it is not intended for this purpose, least not over the internet without encryption or for endpoint.

Recommend discussing the consolidation options further with your local SE and if this is still necessary they can raise any corresponding RFEs that may be required.

Re: Export Log's Harmony Endpoint

itguerreiro — Mon, 06 Mar 2023 12:30:30 GMT

Hello,

I'm trying to perform the configuration from the infinity portal.

Re: Export Log's Harmony Endpoint

itguerreiro — Mon, 06 Mar 2023 12:34:43 GMT

Hello,

My goal is to export the logs to my syslog server and store onprimeses for backup purposes.

Re: Export Log's Harmony Endpoint

Chris_Atkinson — Mon, 06 Mar 2023 12:52:55 GMT

Create a Syslog destination:

Global Settings > Event Forwarding > Manage Destination

Create a forwarding rule:

Global Settings > Event Forwarding > + Add

(Specific services is an option here i.e. "Harmony Endpoint")

Re: Export Log's Harmony Endpoint

_Val_ — Mon, 06 Mar 2023 12:56:13 GMT

Ok, then you are looking into the wrong guide. You need to look into Infinity Portal guide, under Global / Event Forwarding. I see that @Chris_Atkinson already provided you with the info.