MDS and MDLS and masters file

[Peter_Lyndley]

Hi All,

We have a Provider-1 running R80.10 and currently it does everything, policy , logs etc..

However we receive logs to a public IP which is not hosted on any Check Point device, so we have to use the masters file (and GuiDBedit) to achieve the logging.

I have now configured a MD Log server to migrate the logs to, to share the load.

When I change the Log section in masters file to the new log server IP (and push policy), i'm not receiving logs at all ( there is still a connection on port 257 to the cma from the gateway - not the log server), and cert based VPNs stop working.

If i change the IP back to the public IP of the CMA, it works fine again after a policy push, but all logging to the one box.

Is the 'Log' section also used for CRL retrieval ? I would have expected this to be the 'policy' section.

Also is there a way of configuring this to work correctly in the environment we have ?

Has anyone else come across this ?

[_Val_ · Accepted solution]

You are right, this is not an expected behavior. Please open a support case so we could investigate

[Kaspars_Zibarts]

So you are saying that normal log target change on gateway object in CMA is not working? Remember that you will need to install database and push policy for gateway to be able to connect to CLM.

Just sounds very strange that you have to mess with masters file. Never had any problems with it in my 13 years with Provider-1

[_Val_]

For any MGMT behind NAT, there is always two or three options, none of them ideal: automatic NAT rules, masters file and/or dummy MGMT objects.

masters file allows separating logging and management functionality gracefully, especially in cases when it is not Check Point that do address translation. 

[Kaspars_Zibarts]

I fully agree, I'm just wondering as 257 port connection has not changed on CMA so it feels like that gateway object has not been updated with new CLM..  and DB not installed after that to tell CLM to take connections from gateway

Additionally - make sure you can connect from gateway to CLM on port 257 (telnet on port)

And check masters file on CLM not just CMA