Export Log's Harmony Endpoint

[itguerreiro]

Dear all, I have a doubt about the log send configuration.

The documentation informs that it is possible to use ports 514 and 6514 for the TCP and UDP protocols, but when I choose port 514/UDP in the manager, only port 6514 is available via UDP.

Is it possible or not to use port 514/UDP?

https://downloads.checkpoint.com/fileserver/SOURCE/direct/ID/110134/FILE/CP_Harmony_Endpoint_AdminGu...

This information is on page 274.

Thanks,

[PhoneBoy]

What version/JHF is this or are you managing from Infinity Portal?

[itguerreiro]

Hello,

I'm trying to perform the configuration from the infinity portal.

[_Val_]

514 UDP is for syslog. Are you trying to use syslog to export logs? It makes much more sense to use the proprietary TLS protected protocols. 

Also, why would you export the logs TO your management server? Please elaborate on what you are trying to achieve.

[itguerreiro]

Hello,

My goal is to export the logs to my syslog server and store onprimeses for backup purposes.

[Chris_Atkinson · Accepted solution]

Create a Syslog destination:

Global Settings > Event Forwarding > Manage Destination

Create a forwarding rule:

Global Settings > Event Forwarding > + Add

(Specific services is an option here i.e. "Harmony Endpoint")

[_Val_]

Ok, then you are looking into the wrong guide. You need to look into Infinity Portal guide, under Global / Event Forwarding. I see that @Chris_Atkinson already provided you with the info.

[Chris_Atkinson]

On-prem management/log servers have an "accept syslog" option (sk102995 - Part 2) but it is not intended for this purpose, least not over the internet without encryption or for endpoint.

Recommend discussing the consolidation options further with your local SE and if this is still necessary they can raise any corresponding RFEs that may be required.