why does my stand alone Smart Event server authenticating towards the AD?

[andersplarsson]

Hi,

Got two questions I cant get my head around which is:

1. why does my stand alone Smart Event server authenticating towards the AD?

2. Changed credentials for for access towards our AD and changed the credentials in the object "LDAP-Account-Unit" that the gateways are using and of course changed the credentials in our Identity Collectors and all looks fine so far. However our SmartEvent gateway is still using the old credentials and we get failed logins in the AD from this server. 

Were else are these credentials used in the Smart Event config and if only in the object "LDAP-Account-Unit" why is this not being updated. For the gateways I had to push and install policies but should not be needed or cant be done for the Smart Event host.

Regards,

Anders Larsson

[_Val_]

SmartEvent gateway - you probably mean server?

Perform "Install Database" on this server from your main management server and check again.

[andersplarsson]

Yes, server of course. the "Install Database" from main menu in SmartConsole? What exactly does that do? 

[the_rock]

Val makes a good point, just do install database on it. Also, Im not sure what you mean by standalone smart event server...either its standalone (gateway + mgmt (mgmt part has SE enabled) OR its only mgmt that has smart even enabled OR it also could be separate dedicated smart event server ONLY.

[andersplarsson]

This is a separate dedicated Smart Event Server.

[the_rock]

K, great. To answer yuour other ?, install database is literally as if you are pushing policy to the firewall, but you are updating database on the mgmt server.

[andersplarsson]

But I see no authentications done with faulty credentials from the Management-blade. The faulty authentication comes only from Smart Event-host.

/Anders

[_Val_]

You made auth changes through SmartConsole connected to your management server. To make changes effective on your SmartEvent server, install database on it. I think we mentioned that like 10 times already 🙂

[_Val_]

Perform local Install DB action then.

[_Val_]

Although, I am a bit confused here. When you say "separate dedicated SmartEvent Server", what do you mean exactly? Is it or is it not part of your centrally managed environment? If it is a "standalone", how does it receive logs from your security system? Where SIC between this server and your FWs/log servers defined?

[the_rock]

I could be wrong when I say this, but let @andersplarsson configm. I believe he has single mgmt, separate gw (cluster) and dedicated SE server only, so the logs are being forwarded to it from the mgmt server. Not 100% sure, but logically sounds like that might be the case.

Andy

[andersplarsson]

What I mean with stand-alone is that its not integrated or installed on same host as the management-blade.

Regards,

/Anders

[_Val_]

So it is still managed from your SMS. Go to SmartConsole, connect to your SMS and install DB on your SmartEvent server. Let us know if it helps.

[andersplarsson]

Hi, forgot to reply to this. I have opened a TAC case and its still ongoing. The Made the "install database" but no change. 

Regards,

Anders Larsson

[the_rock]

Thanks for letting us know.

Andy