Logging for GAIA portal and SSH access

[Joe_Kanaszka]

Good morning!

We are currently logging admin access to Smart Console via the Check Point Audit logs.

How can we monitor access to the GAIA portal and SSH access to the firewalls?

Shouldn't this show up in the audit logs as well?

Thanks guys for any assistance.

[simonemantovani · Accepted solution]

Did you check this from the admin guide?

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_Gaia_AdminGuide/Topics-GAG/System-...

[Lesley]

This or as alternative a playbook

[Joe_Kanaszka]

Thank you!  I'll ask you the same thing:  Can we simply see GAIA and SSH activity in the Audit logs?  One "pane of glass"  so to speak?

[Lesley]

https://support.checkpoint.com/results/sk/sk181230

Also, check the ''audit'' log tab in Smart Console, you can make smart event reports or view with this based on the log info.

Here is an example of logged web interface log action

[Joe_Kanaszka]

Thank you.  Can we simply see GAIA and SSH activity in the Audit logs?  One "pane of glass"  so to speak?

[simonemantovani]

Yes it is possibile.

I attached a screenshot of the log taken from the Smartconsole for ssh access.

[Joe_Kanaszka]

Thank you!  I found a post from last March:

https://community.checkpoint.com/t5/General-Topics/Gateway-secure-log-Can-these-be-seen-in-Smart-Con...

Is this what you're configuring?

In our case, I'd like to capture SSH to the gateways, whether it be clish or Bash.  I would also like to capture admin access to the GAIA portal itself.  

Is this all done through configuring syslog on the gateways and pointing the syslogs to our SMS/log server?

Thank you again!

[simonemantovani]

If you follow the admin guide, the firewall will send audit logs directly to the management.

set syslog cplogs on

set syslog mgmtauditlogs on

set syslog auditlog permanent

[Joe_Kanaszka]

Thank you!  Question.  What is the difference between your sk and sk102995?

https://support.checkpoint.com/results/sk/sk102995

[simonemantovani]

it's the same (I made reference to the admin guide), the SK 102995 also includes commands to send logs to a 3rd party server.

[Joe_Kanaszka]

Gotcha.  OK.  Question if you have time.  The admin guide leaves out the part that sk 102995 references about making the second change in Smart Console under Logs -> Additional logging configuration and selecting "Accept Syslog messages".

Am I missing something?

[the_rock]

Im fairly positive that option should be checked, brother.

[Joe_Kanaszka]

No I agree.  🙂  It's just strange how the admin guide doesn't mention it.  

[the_rock]

I know, mind you, truth be told, lots of guides for various vendors may not mention things like that : - (

Thanks God for communities like this one!

[the_rock]

Hey Joe,

I know even this screenshot from help section show2s pretty basic explanation, but it does what @simonemantovani mentioned.

 

[Joe_Kanaszka]

Yep - makes sense.  Thanks Andy!

[the_rock]

Always glad we can help!

[the_rock · Accepted solution]

Hey brother,

How you been, all good? I checked what @simonemantovani and @Lesley both said and it makes perfect logical sense. I know both options work as I tested them before.