4-44
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 4 Configuring Firewall Devices
Check Point Devices
Note
Sometimes, the discovery operation times out, in which case you should try again. At other times, a
message appears that states the discovery is taking a long time and that you should proceed to performing
other tasks in MARS.
Step 16
To add this device to the MARS database and continue adding firewall modules manually, click
Submit
.
Result
: The submit operation records the changes in the database tables. However, it does not load the
changes into working memory of the MARS Appliance. The activate operation loads submitted changes
into working memory.
Step 17
Do one of the following:
•
To manually define the child enforcement modules that are managed by this primary management
station, continue with
Manually Add a Child Enforcement Module or Log Server to a Check Point
Primary Management Station, page 4-44
.
•
To edit the settings of the discovered child enforcement modules, continue with
Edit Discovered
Firewall on a Check Point Primary Management Station, page 4-50
.
Step 18
Click
Activate
.
Result
: Once the MARS Appliance is activated, it connects to the Check Point log modules and retrieves
the traffic and audit logs. MARS also begins to sessionize events generated by this device and evaluate
those events using the defined inspection and drop rules. Any events published by the device to MARS
before activation can be queried using the reporting IP address of the device as a match criterion. For
more information on the activate action, see
Activate the Reporting and Mitigation Devices, page 2-27
.
Manually Add a Child Enforcement Module or Log Server to a Check Point Primary Management
Station
If you have not enabled configuration discovery on the primary management station or if one or more of
the managed firewalls uses a log server that is not managed by the primary management station, you can
manually define firewalls or log servers. Your goal should be to represent all of the firewalls managed
by this primary management station and all log servers used by those firewalls and the primary
management station. While MARS does not discover configuration settings of the firewalls, it uses the
defined information to discover topology, calculate attack paths, and identify preferred mitigation points
in the network.
For example, if you are defining a primary management station that represents a CMA, you must define
the CLM associated with that CMA. Any firewalls managed under that CMA may either act as their own
log servers, publish information to the CLM, or publish information to a MLM. In the case of the later,
you must define that relationship by defining the firewalls and then specifying which log servers pull
their traffic and audit logs. First, however, must also define the MLM settings, as it is a log server that
external to the perspective of the CMA, and it cannot be referred by a firewall until it has been defined.
The CLM, however, would be considered part of the CMA (assuming the reporting IP and LEA settings
are specified), so you would not define a separate child enforcement module to represent it. Instead, you
would select the Management option in the Log Info dialog for firewalls that use the CLM as their log
server. For more information on selecting the log server option, see
Specify Log Info Settings for a Child
Enforcement Module or Log Server, page 4-52
.
To manually define a child enforcement module that is managed by the primary management station or
a log server to which either the primary management station or a child enforcement module publishes
its audit and security logs, follow these steps:
