topic Re: Checkpoint Log Server Origin in General Topics

Checkpoint Log Server Origin

Ihenock1011 — Mon, 16 Dec 2024 14:03:27 GMT

Hi All,

We have a Checkpoint Security Gateway and SMS Server running R81.10. Previously, all gateways sent logs to the SMS . After configuring a dedicated log server, the gateways are now sending logs to this log server. However, some gateways still show the SMS as the log server origin network reachability(Ping to the log server) is okay. What could be causing this issue, and how can we resolve it?

Thanks,

Re: Checkpoint Log Server Origin

the_rock — Mon, 16 Dec 2024 15:24:38 GMT

Hey bro,

How do you have below configured? That could be an issue.

Andy

Re: Checkpoint Log Server Origin

AkosBakos — Mon, 16 Dec 2024 15:51:39 GMT

Hi,

A database install should help also 🙂

Akos

Re: Checkpoint Log Server Origin

AkosBakos — Mon, 16 Dec 2024 15:57:36 GMT

Hi @Ihenock1011

I would like to comlement my earlier post 🙂

Dig a little bit deeper.

What does this comman say on the LOG server?

#cpstat ls -f logging

All the clusters are listed, and some of them are "disconnected" state?

The logging uses TCP 257 -> this prot is open from the clusters to the LOG server?

And check this sk: https://support.checkpoint.com/results/sk/sk40090

Akos

Re: Checkpoint Log Server Origin

the_rock — Mon, 16 Dec 2024 19:53:52 GMT

I applaud 1st and 2nd response brother 🙂

Andy

Re: Checkpoint Log Server Origin

Ihenock1011 — Mon, 16 Dec 2024 20:00:39 GMT

Andy, the same way as your screenshot for all securitygateway.

Re: Checkpoint Log Server Origin

the_rock — Mon, 16 Dec 2024 20:04:00 GMT

In my lab, no issues with it. I would need to see for myself to verify the config is right.

Andy

Re: Checkpoint Log Server Origin

Ihenock1011 — Tue, 17 Dec 2024 05:38:49 GMT

@AkosBakos Yes, for those security gateways in the cluster, the status shows disconnected. How can I resolve this issue then?

Re: Checkpoint Log Server Origin

AkosBakos — Tue, 17 Dec 2024 07:45:26 GMT

Hi @Ihenock1011

Sorry, I'm in an another timezone 🙂

Because I don't know the exact situation, I suggest you to follow the steps in this sk:

And check this sk: https://support.checkpoint.com/results/sk/sk40090

First, I would start a really basic step: #telnet <LOGserverIP> 257 from the cluster

The LOG server is in the same subnet as the MGMT?

Akos

Re: Checkpoint Log Server Origin

the_rock — Tue, 17 Dec 2024 12:28:06 GMT

Does it give a reason why they are disconnected? That could be why this is happening. Can you send a screenshot please?

Andy

Re: Checkpoint Log Server Origin

Ihenock1011 — Tue, 17 Dec 2024 13:44:09 GMT

Connectivity seems to be fine. I might need to create a TAC case to further investigate the issue. Thank You Guys for your usual help I will update you their response here.

Re: Checkpoint Log Server Origin

the_rock — Tue, 17 Dec 2024 13:47:01 GMT

Maybe before you open the case, just run tcpdumps on given port(s) and it will show you for sure if thats the problem.

Andy