Send Log to other SIEM server using site-to-site VPN

Aiman_Azzim — Tue, 18 Dec 2018 15:12:23 GMT

Hi all,

This is my first time using checkmate. I just want to ask some question regarding sending Syslog using LogExporter via Site-to-Site (S2S) VPN. Basically, we want to create S2S VPN with 3rd party firewall. I have done configure interoperable device on SmartConsole. The issue is when I trying to ping from my checkpoint management to other SIEM server, the connection is drop. (You may refer my network diagram for detail). From another side, they said I advertise my VPN tunnel using Public IP instated local subnet

I have viewed the log from SmartView tracker and here the detail log;

Traffic

Source: y.y.y.4 (physical Public IP Gateway)

Destination: x1.x1.x1.10 (External Syslog Server)

Protocol: ICMP

Interface: eth1 (Public IP Port)

NAT additional rule number: 0

NAT rule number: 0

Xlate Src: y.y.y.5 (Virtual Public IP Gateway)

VPN Peer Gateway: y.1.y1.y1.2 (Public IP 3rd Party Firewall)

From 3rd party firewall side, they define my peer local subnet as x.x.x.253 and x.x.x.200. On my VPN Domain, I have set IP x1.x1.x1.10. Should I create manual NAT on CheckPoint or define CheckPoint Public IP as peer local subnet?

Can someone advise me on this? Thank you in advance

Re: Send Log to other SIEM server using site-to-site VPN

PhoneBoy — Wed, 19 Dec 2018 00:03:53 GMT

Make sure your VPN community has NAT disabled:

Re: Send Log to other SIEM server using site-to-site VPN

Aiman_Azzim — Wed, 19 Dec 2018 01:52:46 GMT

Hello Dameon,

Yes, I already tick on "disable NAT inside the VPN community"

thanks,

Re: Send Log to other SIEM server using site-to-site VPN

PhoneBoy — Wed, 19 Dec 2018 13:41:37 GMT

From what end is the above log entry?

Not clear from your description.

In any case, having the remote end include the public IP of your gateway in their definition of the encryption domain might also help.

topic Re: Send Log to other SIEM server using site-to-site VPN in General Topics

Send Log to other SIEM server using site-to-site VPN

Re: Send Log to other SIEM server using site-to-site VPN

Re: Send Log to other SIEM server using site-to-site VPN

Re: Send Log to other SIEM server using site-to-site VPN