Enterasys Security Information and Event Manager, Configuration Manual

Page: 273 / 426

Configuring DSMs
Nortel Switched Firewall 6000 257
To configure SIEM to receive events from an Nortel Switched Firewall 6000 using
syslog:

From the Log Source Type drop-down list box, select the Nortel Switched
Firewall 6000 option.
For more information on configuring log sources, see the Log Sources User Guide .
For more information, see http://www.nortel.com/support.
Integrating Nortel
Switched Firewall
Using OPSEC
This method ensures the SIEM Nortel Switched Firewall 6000 DSM accepts Check
Point FireWall-1 events using OPSEC.
NOTE
Depending on your Operating System, the procedures for the Check Point
SmartCenter Server may vary. The following procedures are based on the Check
Point SecurePlatform Operating system.
To enable Nortel Switched Firewall and SIEM integration, you must:
Step 1
Reconfigure Check Point SmartCenter Server. See Reconfiguring Check Point
SmartCenter Server .
Step 2
Configure the OPSEC LEA protocol in SIEM.
To configure SIEM to receive events from a Check Point SmartCenter Server using
OPSEC LEA, you must select the
LEA option from the Protocol Configuration
drop-down list box when configuring LEA.
For more information, see the Log Sources User Guide .
Step 3
Configure the log source in SIEM.
To configure SIEM to receive events from a Nortel Switched Firewall 6000 device
using OPSEC you must select the
Nortel Switched Firewall 6000 option from the
Log Source Type drop-down list box. For more information on configuring log
sources, see the Log Sources User Guide .
For more information, see http://www.nortel.com/support.
Reconfiguring Check Point SmartCenter Server
This section describes how to reconfigure the Check Point SmartCenter Server. In
the Check Point SmartCenter Server, create a host object representing the SIEM
system. The leapipe is the connection between the Check Point SmartCenter
Server and SIEM.
To reconfigure the Check Point SmartCenter Server:
Step 1
To create a host object, open the Check Point SmartDashboard user interface and
select
Manage > Network Objects > New > Node > Host .
Step 2
Type the Name, IP Address, and optional Comment for your host.
Step 3
Click OK .