Cisco CS-MARS-20-K9 - Security MARS 20, Руководство пользователя

Страница: 183 / 588

4-55
User Guide for Cisco Security MARS Local Controller
78-17020-01
Chapter 4 Configuring Firewall Devices
Check Point Devices
Verify Connectivity Between MARS and Check Point Devices
After defining the Check Point device and clicking Activate in the MARS web interface, the MARS
Appliance connects to the log servers and pulls the traffic and audit logs stored on them. You can verify
that these transactions are successful using the following method:
•
Perform an ad hoc query for Event Types/Sessions specify to the Check Point primary management
station.
Result : The netstat command should display two connections per log server.
Remove a Firewall or Log Server from a Check Point Primary Management Station
If the configuration of your network changes so that a firewall or log server is no longer managed by the
primary management station under which it is defined, you must remove the child enforcement module.
To remove a child enforcement module from the primary management station, follow these steps:
Step 1
Select Admin > System Setup > Security and Monitor Devices .
Step 2 From the Security and Monitor Devices list, select the host that represents the primary management
station of the Check Point server and click
Edit .
Such devices have CheckPoint Management Console as an entry in the Device Type column.
Step 3 Click Next to access the Reporting Applications tab.
Step 4
Select CheckPoint Management Console from the Device Type list and click Edit .
The Access Information page appears.
Step 5 Under Firewall & Log Server Settings, check the box next to the child enforcement module that you want
to remove.
Step 6
Click Remove .
Result : The Confirmation screen appears.