Enterasys Security Information and Event Manager, Configuration Manual

Page: 271 / 426

Configuring DSMs
Nortel Switched Firewall 5100 255
Integrating Nortel
Switched Firewall
Using OPSEC
This method ensures the SIEM Nortel Switched Firewall 5100 DSM accepts Check
Point FireWall-1 events using OPSEC.
NOTE
Depending on your Operating System, the procedures for the Check Point
SmartCenter Server may vary. The following procedures are based on the Check
Point SecurePlatform Operating system.
To enable Nortel Switched Firewall and SIEM integration, you must:
1
Reconfigure Check Point SmartCenter Server. See Reconfiguring Check Point
SmartCenter Server .
2
Configure the log source in SIEM. For more information, see Configure the Log
Source within SIEM .
Reconfiguring Check Point SmartCenter Server
This section describes how to reconfigure the Check Point SmartCenter Server. In
the Check Point SmartCenter Server, create a host object representing the SIEM
system. The leapipe is the connection between the Check Point SmartCenter
Server and SIEM.
To reconfigure the Check Point SmartCenter Server:
Step 1
To create a host object, open the Check Point SmartDashboard user interface and
select
Manage > Network Objects > New > Node > Host .
Step 2
Type the Name, IP Address, and optional Comment for your host.
Step 3
Click OK .
Step 4
Select Close .
Step 5
To create the OPSEC connection, select Manage > Servers and OPSEC
applications > New > OPSEC Application Properties .
Step 6
Type the Name and optional Comment.
The name you type must be different than the name in Step 2 .
Step 7
From the Host drop-down menu, select the host object you have created in Step 1 .
Step 8
From Application Properties, select User Defined as the vendor.
Step 9
From Client Entries, select LEA .
Step 10
Click Communication.
Step 11
Choose a password in the provide field. This password is necessary when pulling
the certificate to the Firewall Director.
Step 12
Click OK and then click Close .
Step 13
To install the Security Policy on your firewall, select Policy > Install > OK .