4-34
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 4 Configuring Firewall Devices
Check Point Devices
•
For CPMI, SSLCA is the authentication method and communications occur over TCP 18190.
To review or change the access type settings, follow these steps:
Step 1
Log on to the Check Point server.
For Provider-1 and SiteManager-1, this server is the MDS, MLM, or CLM. Otherwise, it is the
SmartCenter server.
Step 2
Open the
fwopsec.conf
file found in the subdirectory for each CMA and CLM.
The following example uses the find command to locate the file. Customer1 identifies the CLM.
[Expert@logger]# find . -name "fwopsec.conf" -print
./var/opt/CPfw1-R55/conf/fwopsec.conf
./var/opt/CPmds-R55/customers/Cust1Log/CPfw1-R55/conf/fwopsec.conf
[Expert@logger]# cd /var/opt/CPmds-R55/customers/Cust1Log/CPfw1-R55/conf
Step 3
Using a text editor, such as vi or Notepad, edit the
fwopsec.conf
file and modify the LEA and CPMI
communication settings as needed.
Step 4
Save your changes to the file.
Step 5
Repeat
Step 2
through
Step 4
for each CLM and CMA.
Step 6
Restart the Check Point server after the changes are made.
Result
: The CPMI and LEA servers are restarted, which reloads their configuration information, and
ensures they are listening to the correct ports for session requests.
Step 7
Continue with
Create and Install Policies, page 4-34
.
Create and Install Policies
You must create firewall policies that permit the MARS Appliance to access the relevant ports of the
Check Point central management server and any remote log servers. The default ports are as follows:
•
TCP port 18190.
Used by CPMI to discover configuration settings.
•
TCP port 18210.
Used to retrieve the certificate from the Certificate Authority on the SmartCenter,
MDS, MLM, CMA, or CLM.
•
TCP port 18184.
Used to pull security event logs from the log servers, such as the MLM or CLM.
However, you must use the CPMI and LEA servers settings specified in
Select the Access Type for LEA
and CPMI Traffic, page 4-32
. When the policies are defined, you must install them on any firewall
modules that inspect traffic between the Check Point components and the MARS Appliance.
If the management server has a Check Point firewall installed, follow these steps:
Step 1
Log in to the correct Check Point user interface using an account with administrative privileges.
If you are using SmartCenter, use the SmartDashboard for that server. If you are using Provider-1 or
SiteManager-1 NG FP3 or NG AI (R55), use the SmartDashboard of the CMA. If you are using
Provider-1 or SiteManager-1 NGX, use the MDG.
Step 2
If Check Point firewall components reside between the Check Point components (central management
and log server) and the MARS Appliance monitoring those components, define the security policies that
allow management and log traffic between those devices.
