000011583 - Explanation of product filtering in Lea client connections and its usage to filter checkpoint logs

Document created by RSA Customer Support Employee on Jun 14, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000011583
Applies ToenVision 3.7.x, enVision 4.0.x
IssueExplanation of product filtering in Lea client connections and its usage to filter checkpoint logs
You have created a single lea client connection, but have resulted in multiple checkpoint devices shown in manage monitored device.
CauseThis is because checkpoint seperate the logs for each network interface in the appliance. Thus a single firewall can produce multiple devices in enVision. This causes license issue with enVision
Resolution

To clarify the use of product filtering, it is used for 2 purposes

  1. To assign any logs coming from this lea connection to have a specifics address, or
  2. Ignore any logs coming from this lea connection according to its product type

 

To explain further on (1), when you connect to the checkpoint SmartView to collect logs, those logs will be divided according to the interface of the FW, and will create a new device in enVision according to each network interface of the FW (This is what customer being observing). To resolve this, in the filter string, we can configure to have logs coming from a particular product (e.g: VPN-1/Express) to have a specifics IP address. To do this, fill in the product name (e.g: VPN-1 Pro/Express, SecureClient), uncheck the ignore button, and then type in the IP address you wish to address for this product. For example, I can have all the logs generated by the VPN-1 Pro/Express device will be logged as 10.32.27.177, while all the logs generated by SecureClient device will be logged as 10.32.27.188

  

This way, you can restrict how many different IP will be generated from this single connection point (instead of enVision generating a number of devices by the FW interface). Technically, you can assign all products to have the same IP address. In this case, this lea connection point will generate only 1 single device, where all the logs will appear to come from the same IP. Certainly this won?t affect the source / destination address as recorded in the message payload, i.e: no information in the actual log will be altered, rather we are just altering the source IP where these logs are come from

 

Thus, to ensure we can properly manage the number of devices generated by this connection point, we need to ensure that in our product filtering sections, we have created an entry for each of the products displayed in the Checkpoint SmartView.

 

On the other hand, the product filtering can also be used to just ignore any product logs that you are not interested in. For e.g: I?m not interested in any logs collected by the FloodGate-1. In this case, I can use the ignore checkbox to have all of these logs dropped. In this case, it will also help to minimise the number of devices generated by this lea connection

  

Because we are ignoring logs collected by the FloodGate-1, it is contradictory (in its usage) to have this assign an IP address. Thus when the Ignore checkbox is checked, the IP address field becomes unavailable for that product

 

Legacy Article IDa48922

Attachments

    Outcomes