Export log from 6200 appliance to SIEM Server

[NhatKha]

Hello everyone,

Currently, I have question about export log from the 6200 appliance (security log + system log) to Splunk server.

Product: 6200 appliance + cluster + distributed manage by Smart-1 Cloud
Version: R81.20 take 84

Cluster 6200 placed at HO ; The Splunk server placed at our Data Center.
The Splunk server is the internal server  => can't public (our internal policy + high risk) => can't use Smart-1 Cloud export log to it (Smart-1 Cloud require to public server if you want export log to it).
The only way is export log direct from 6200 cluster to Splunk Server using VPN tunnel. But I can't find any feature or document say about it.
Does anyone facing this problem before? Please help me.

Noted: My company already using 12 SMB appliance and it's have the feature External Log Servers > add syslog server (I used this feature export log to Splunk Server through VPN tunnel) 

Thanks & Best Regards,

Do Nhat Kha

[PhoneBoy]

You can export Firewall (not other blade logs) directly from a gateway.
See: https://support.checkpoint.com/results/sk/sk87560 

For logs from other blades, you are subject to the restrictions of Smart-1 Cloud.

[NhatKha]

Thank you, I will try the sk87560 that you suggest and will respond with results later today.

[JP_Rex]

Another solution might be to setup a dedicated log server (CPSM-NGSM5-LOG). Not cheap ,but you can place it where you need it.

Regards

Peter

[PhoneBoy]

Don't believe this is possible with Smart-1 Cloud, but I'll double check.