topic Re: Checkpoint Gateway not sending logs to sms over wan in General Topics

Checkpoint Gateway not sending logs to sms over wan

AmitS — Wed, 14 Dec 2022 18:58:38 GMT

Hi Guys,

I have an CMS which is located behind checkpoint gw at Site A.

I have another GW2 at Site B which is managed by CMS at Site A over Internet.

We are not able to view logs of GW2 which is at Site B on the CMS which is at Site A.

I am not sure where the logs are going.

The master file in GW2 has entry with the CMS host name.

Can anyone guide how can i resolve this?

Re: Checkpoint Gateway not sending logs to sms over wan

PhoneBoy — Wed, 14 Dec 2022 19:42:17 GMT

Version/JHF level of all components, please.
Does the management server require NAT to be reached by tie Site B gateway?
If so, is such NAT configured in the management object?

The masters file is generally legacy and should not need to be configured.
And if you are going to configure it, you would use the IP address, not the hostname.
Also, you need to perform some additional steps: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102712

Re: Checkpoint Gateway not sending logs to sms over wan

AmitS — Thu, 15 Dec 2022 07:14:59 GMT

Version R81.10 with latest JHF.

Does the management server require NAT to be reached by tie Site B gateway? : We have natted to send the management traffic vis ISP1 from Site A.

Re: Checkpoint Gateway not sending logs to sms over wan

PhoneBoy — Thu, 15 Dec 2022 14:46:32 GMT

Do not use the word “latest” to specify your JHF level, please specify the exact take number.

What is your precise ISP Redundancy configuration?
Please provide screenshots and explain what your precise goals are with this configuration.

My guess is that you’ve got an asymmetric routing configuration that’s causing issues (traffic coming in over ISP-2 then going out over ISP-1…or vice versa).
You should be able to confirm this with a tcpdump or fw monitor on the relevant interfaces.
The gateways attempt to connect to the management server on TCP port 257.

Re: Checkpoint Gateway not sending logs to sms over wan

the_rock — Thu, 15 Dec 2022 14:52:05 GMT

Can you see if local log file is growing?

watch -d $FWDIR/log from expert mode

Andy