IBM QRadar

IBM QRadar

Join this online user group to communicate across Security product users and IBM experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only

  • 1.  Integrate checkpoint firewall

    Posted Thu May 13, 2021 12:00 PM
    Hello community,
    Im trying to integrating the checkpoint firewall to qradar, i tried 2 diferent protocol and none of those worked to me.
    I tried the syslog integration but i only received operative system events, i followed this guide:
    https://www.ibm.com/docs/en/dsm?topic=point-integrate-check-by-using-syslog#c_dsm_guide_checkpoint_firewall1_syslogintegration
    I tried to integrate it using OPSEC/LEA but i'm having different problems:
    1) I have 2 gateways, 1 device where gateways are connected to and 1 manager, as i know in the log source i have to use the manager IP, is that ok?
    2) Using the manager IP i see this errors in the qradar.error log:
       

    May 13 09:18:50 ::ffff:172.31.1.10 [ecs-ec-ingress.ecs-ec-ingress] [Thread-870535] com.q1labs.semsources.sources.LEA.LEAProvider: [ERROR] [NOT:0000003000][172.31.1.10/- -] [-/- -] Opsec error. rc=-1 err=-100 General error in Certificate Authority

    May 13 09:18:50 ::ffff:172.31.1.10 [ecs-ec-ingress.ecs-ec-ingress] [Thread-870535] com.q1labs.semsources.sources.LEA.LEAProvider: [ERROR] [NOT:0070003100][172.31.1.10/- -] [-/- -]Failed to pull the certificate for the LEA server 10.10.10.18.

    May 13 09:18:50 ::ffff:172.31.1.10 [ecs-ec-ingress.ecs-ec-ingress] [Thread-870535] com.q1labs.semsources.sources.LEA.LEAProvider: [ERROR] [NOT:0070003100][172.31.1.10/- -] [-/- -]An error occured when trying to configure a source connection for provider LEA Provider 10.10.10.18

    May 13 09:18:50 ::ffff:172.31.1.10 [ecs-ec-ingress.ecs-ec-ingress] [Thread-870535] com.q1labs.semsources.sources.LEA.LEAConfigurationException: Code=Failed to pull the certificate for the LEA server 10.10.10.18, Subcode=N/A, Reason=N/A

    May 13 09:18:50 ::ffff:172.31.1.10 [ecs-ec-ingress.ecs-ec-ingress] [Thread-870535] at com.q1labs.semsources.sources.LEA.LEAProvider.preExecuteConfigure(LEAProvider.java:356)

    May 13 09:18:50 ::ffff:172.31.1.10 [ecs-ec-ingress.ecs-ec-ingress] [Thread-870535] at com.q1labs.semsources.sources.base.SourceProvider.run(SourceProvider.java:181)

    May 13 09:18:50 ::ffff:172.31.1.10 [ecs-ec-ingress.ecs-ec-ingress] [Thread-870538] com.q1labs.semsources.sources.LEA.LEASource: [ERROR] [NOT:0070003100][172.31.1.10/- -] [-/- -]There appears to be a configuration issue with the provider connection 'LEA Provider 10.10.10.18'.

    I exported the certificate and copied it to the collector but i see the same error, the only error that is not generating again is the certificate error.

    I would like to know if some of you had success integrating the checkpoint firewall to qradar, what is the best protocol to use and what i'm doing bad.

    I really would appreciate if some of you could help me with this.

    ------------------------------
    Johan Lopez
    ------------------------------


  • 2.  RE: Integrate checkpoint firewall

    Posted Fri May 14, 2021 04:46 AM
    I recall someone told me last year they had problems integrating using OPSEC/LEA, and ended up enabling 3DES on CheckPoint side after reading this and this.

    ------------------------------
    Dusan VIDOVIC
    ------------------------------

    Original Message