4-43
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 4 Configuring Firewall Devices
Check Point Devices
•
Login
— Identifies the Check Point administrative account to be used to discover configuration
settings.
•
Password
— Identifies the password asscociated with the Login account.
Step 10
Specify values for the following fields:
•
LEA Access Type
— If a log server is running on this primary management station select
ASYMSSLC
,
CLEAR
, or
SSLCA
. You must have entered an address in the Reporting IP field on
the host that represents this primary management station. This value identifies the authentication
method to use for LEA traffic, which is the protocol used to pull security logs from the log server.
For more information on the access type, see
Select the Access Type for LEA and CPMI Traffic,
page 4-32
.
•
LEA Port
— Verify that the port number corresponds to the value specified in the LEA_SERVER
auth_port line of the
fwopsec.conf
file. The default authentication method for configuration
discovery is SSLCA and data is passed on port 18184. For more information on this setting, see
Select the Access Type for LEA and CPMI Traffic, page 4-32
.
Step 11
If this device uses SSLCA or ASYMSSLCA as an authentication method, specify values for the
following fields (Otherwise, the authentication method is CLEAR. Skip to
Step 12
.):
•
Certificate
— Either select the previously defined server from the list or click
Add
to define a new
certificate authority and continue with
Add a Check Point Certificate Server, page 4-47
.
•
Client SIC Name
— Enter the SIC DN of the OPSEC application for the MARS Appliance. This
value was obtained in
Define an OPSEC Application that Represents MARS, page 4-27
.
•
Server SIC Name
— Enter the SIC DN for this primary management station. This value was
obtained in
Obtain the Server Entity SIC Name, page 4-30
. Typically, this value is the SIC DN of
the SmartCenter server or of the CMA. In the case of Provider-1 and SiteManager-1 NGX (R60),
this value is the SIC DN of the MDS that manages the CMA.
Step 12
(Optional) To enable MARS to retrieve MIB objects for this reporting device, enter the device’s
read-only community string in the SNMP RO Community field.
Before you can specify the SNMP RO string, you must define an access IP address on host that
represents the primary management station and you must configure the Access Information settings on
the primary management station. MARS uses the SNMP RO string to perform resource utilization
monitoring. Currently, it is not used for configuration or log discovery.
Step 13
(Optional) To enable MARS to monitor this device for anomalous resource usage, select
Yes
from the
Monitor Resource Usage list.
Before you can enable this feature, you must provide a SNMP RO Community string.
Result
: MARS monitors the device for anomalous consumption of resources, such as memory and CPU.
If anomalies are detected, MARS generates an incident. Resource utilization statistics are also used to
generate reports. For more information, see
Configuring Resource Usage Data, page 2-41
.
Step 14
(Optional) To specify the route information for a firewall running on this primary management station,
continue with
Define Route Information for Check Point Firewall Modules, page 4-50
.
Step 15
(Optional) If you defined an access IP and selected and configured an access type, click
Discover
to
determine the device settings.
Result
: If the username and password are correct and the MARS Appliance is configured as an
administrative host for the device, the “Discovery is done.” dialog box appears when the discovery
operation completes. Otherwise, an error message appears. After the initial pull, the MARS Appliance
pulls based on the schedule that you define. For more information, see
Scheduling Topology Updates,
page 2-39
.
