Checkpoint Firewall

Checkpoint Firewall

CheckPoint Firewall log source integration fetches and normalizes logs from CheckPoint Firewall devices so you can visualize and analyze the log data through the dashboards and reports. Dashboards visualize events including source addresses, destination addresses, services, actions, outbound connection by countries, denied connection, protocols and secure remote login detected in your network. You can customize dashboards to perform in-depth analysis by changing the data used in a search. Checkpoint Firewall includes the Syslog Collector based Check Point log source template, which ensures consistency in collecting, processing and analyzing

You can get the following Checkpoint Firewall product logs into Logpoint:

• Check Point Firewall version r80.10 and later

---

Log Ingestion

• Download the integration .pak file, or make sure it is installed.

• There are two ways to ingest the logs:

  • Log Source Template (recommended)

  • Using a device

• Configure Checkpoint Firewall Security Management Server.

• Logpoint automatically generates required certificates to retrieve the Check Point Firewall logs. If automatic generation fails, you can generate them using the command line: https://newportal.logpoint.com/Content/Integrations/CheckPoint%20Software/Checkpoint%20Firewall/3.Generate%20Certificate.htm

• After setting up and configuring the integration, check:

  • Normalized Keys-Value Pairs/Vendor Field Mapping

  • Label Packages

After your logs are ingested, you can get started using Logpoint Analytics and your own use cases: https://newportal.logpoint.com/Content/Integrations/CheckPoint%20Software/Checkpoint%20Firewall/2.CheckPoint%20Firewall%20Analytics.htm

---

Checking Installed Integrations

1. In the Navigation Bar, click System Settings.

2. Click Applications.

3. You can search for the integration, or use the column headers to filter the list.

---

Downloading and Installing

1. Download the .pak file from the Service Desk: https://servicedesk.logpoint.com/hc/en-us

2. Go to Settings >> System Settings and click Applications.

3. Click Import.

4. Browse to the downloaded .pak file.

5. Click Upload.

6. After installing it, you can find it under Settings >> System Settings >> Plugins.

---

Use Log Source Template to Ingest Logs

You must create a log source using the log source template to receive the normalized CheckPoint Firewall logs. See Creating Log Source via a Template: https://newportal.logpoint.com/docs/log-sources/en/latest/Log%20Source%20Template.html#creating-log-source-via-a-template

---

Use Devices to Ingest Logs

To use a device there are six main steps. Use the stepper below to follow the sequential process.

1

Configure a Repo

A repository (repo) is a log storage location where device logs are routed to. A Routing Policy determines which repo logs are sent to. Repo properties control retention, storage tier, replication, and related behavior.

Steps:

• Go to Settings >> Configuration and click Repos.

• Click Add.

• Enter a Repo Name.

• Select a Repo Path to store incoming logs.

• Set a Retention Day to keep logs in a repository before automatic deletion.

• You can add and remove multiple Repo Path and Retention Day.

• Select a Remote Logpoint and set Available for (day).

• Click Submit.

Screenshot:

2

Normalize Checkpoint Firewall Logs

Normalization translates raw log messages into Logpoint taxonomy so searches and correlations work across vendors.

Logpoint uses two types of normalizers:

• Compiled Normalizers — hard-coded and fast.

• Normalization Packages — regex/signature-based packages that extract key-value pairs.

Normalization Policies combine Compiled Normalizers with Normalization Packages. Create separate policies for similar device types. Place the most commonly used normalizers at the top of the list.

Checkpoint Firewall uses:

Compiled Normalizers:

• CheckPointOpsecCompiledNorm Noalizer

• CheckPointInfinityCompiledNormalizer

• CheckPointFirewallCEFCompiledNormalizer

Normalization Packages:

• LP_ChkPoint Endpoint Security

• LP_CheckPoint Firewall

• LP_CheckPoint Firewall Opsec Generic

• LP_CheckPoint Firewall Process

Adding a Normalization Policy:

1. Go to Settings >> Configuration and click Normalization Policies.

2. Click Add.

3. Enter a Policy Name.

4. Select required Compiled Normalizers and Normalization Packages.

5. Click Submit.

Screenshot:

3

Configure a Processing Policy

A Processing Policy combines normalization, enrichment and routing policies into a single policy and assigns it to a device.

Steps:

1. Go to Settings >> Configuration and click Processing Policies.

2. Click Add.

3. Enter a Policy Name.

4. Select the previously created Normalization Policy.

5. Select the Enrichment Policy.

6. Select the Routing Policy.

7. Click Submit.

Screenshot:

4

Configure a Fetcher

Fetcher retrieves logs from sources and forwards them to Logpoint. Ensure the fetcher has permissions by adding required parameters to the log source configuration and set a fetch interval.

There are two fetchers for Checkpoint Firewall:

• OPSEC Fetcher

• Adhoc OPSEC Fetcher

Configuring the OPSEC Fetcher

1. Go to Settings >> Configuration and click Devices.

2. Click the Add collectors/fetchers icon in Actions.

3. Click OPSEC Fetcher.

4. Select a Processing Policy.

5. Select a Charset.

6. Click Policy.

   • You can configure an OPSEC Policy via Settings >> System >> Plugins (Manage for OPSEC Fetcher).

7. Click Add.

8. Options:

   • Select Is log server? if the server is a log server, then select the required Management Server.

   • In Application Name, enter the name of the OPSEC application created in SmartDashboard.

     • Select a Time Zone.

     • Enter the SIC One Timer Password.

9. Enter the Device IP, ClientDN, and ServerDN.

10. Select where to put the Certificate on. If Remote LPC is selected, choose the required remote machine.

11. Click Submit.

Screenshots:

Configuring the Adhoc OPSEC Fetcher

1. Go to Settings >> Configuration and click Devices.

2. Click the Add collectors/fetchers icon in Actions.

3. Click Adhoc OPSEC Fetcher.

4. Click Add.

5. Enter a Name.

6. Select the Start Date Time and End Date Time.

7. Select a Parser, a Processing Policy and a Charset.

8. Click Submit.

Screenshot:

5

Configure CheckPoint Security Management Server

Note: Interfaces and UI may change; refer to official Checkpoint documentation when needed.

There are four configuration areas:

• Check Point Security Management Server Version r80.10

• SmartDashboard

• Log Exporter

• Source Configuration of Check Point Firewall

Before you begin, make the Check Point server listen on port 18184.

Configure CheckPoint Security Management Server v. r80.10

1. SSH into the server and enter expert mode:

   expert

2. Open fwopsec.conf:

   vi $FWDIR/conf/fwopsec.conf

3. Uncomment:

   lea_server auth_port 18184 lea_server port 0

4. Add (use sslca as auth type):

   lea_server auth_type sslca

5. Save and exit.

6. Restart server:

   cpstop cpstart

   OR

   cprestart

Configuring the SmartDashboard for r80.10

1. Log into SmartDashboard using admin credentials.

2. Go to New >> More >> Server >> OPSEC Application >> Application.

3. Fill parameters.

4. Click Communication to initialize the SIC-OneTime-Password. The OPSEC Fetcher uses Communication DN and the SIC-OneTime-Password.

5. Save the Application.

6. Go to Security and Policies.

7. Add a policy Rule.

8. Select required firewall services or Any.

9. Install Policy and Database.

Key values you will need:

• Application Name — name of OPSEC application

• SIC-OneTimer Password — password created for SIC-APP

• Client DN — communication DN from SmartDashboard

• Server DN — communication DN (prefix CN=cp_mgmt). You can also view it via server browser.

Login format:

https://<ip_of_management_server>:<port>

Configuring the CheckPoint Log Exporter

• CheckPoint Log Exporter sends logs from CheckPoint Log Server to Logpoint.

• Supports Syslog and CEF formats, Logpoint 6.x+, multiple values for same field, and log filtering.

Install CheckPoint R.80.30:

• Install from: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk144293#Downloads

• Choose standalone/gateway version with Security Gateway and Security Management appliances on same machine.

Install Gaia OS in Open Server:

• Use VMware ESXI UI (https://10.45.1.251/ui/) to create VM, select Linux / Other Linux 64 bit, configure storage, power ON VM, install Gaia, configure keyboard, partitions, admin password, management interface (static IP, netmask, gateway — do not select DHCP), complete install and reboot.

Configuring the Security Management Server or Security Gateway on Gaia:

• Browse to:

  https://<IP-Address-of-host-machine>

• Provide admin credentials, select R80.30 application, configure IPv4, NTP, installation type (Security Gateway and/or Security Management), define admin, select Any IP Address, finish and reboot as prompted.

Configuring Log Exporter via SSH on Log Server:

1. SSH into host:

   ssh admin@<IP-Address-of-host-machine>

2. Change log settings:

   lock database override

3. Enter expert mode:

   expert

4. Create expert password:

   set expert-password

5. Check checkpoint configuration:

   cpconfig

   • To add GUI Clients manually: select 3 (GUI Clients), follow prompts to add IP.

6. Check log exporter status:

   cp_log_export status

7. Add log exporter (target server = Logpoint):

   cp_log_export add name [domain-server] target-server<ip> target-port<port> protocol <(udp|tcp)> format <(syslog)|(cef)>

   Example:

   cp_log_export add name LogPoint target-server 1.1.1.1 target-port 1 protocol tcp format <(syslog)|(cef)>

8. Start log exporter:

   cp_log_export start

9. Show forwarded rules:

   cp_log_export show

10. Change parameters and restart:

    cp_log_export set name [domain-server] parameter-name new-value
    cp_log_export restart name LogPoint

11. Stop log exporter:

    cp_log_export stop

SmartConsole (via Remote Desktop) can monitor Log Server and Management Center status.

Source Configuration of the Check Point Firewall

Gateway logs are sent to the Security Management server by default. Gateways can be configured to send logs directly to Syslog servers. First define Syslog servers, then update gateway logging properties.

Defining Syslog Servers (SmartDashboard):

1. In SmartDashboard, click Firewall.

2. In Servers and OPSEC Applications object tree, right-click Servers >> New >> Syslog.

3. In SyslogProperties, enter:

   • Name

   • Optional comment

   • Host

   • Port (default 514)

   • Version (BSD Protocol or Syslog Protocol)

Configuring Gateways to Send Logs to Syslog Servers:

• Gateways can send logs to multiple Syslog servers (servers must be of same type: BSD or Syslog Protocol).

1. In SmartDashboard, go to Gateway Properties >> Logs.

2. In Send logs and alerts to these log server table, click Green button to add Syslog servers.

3. Click OK.

4. Install policy.

Enabling Syslog in Kernel:

• Controlled by fwsyslog_enable kernel parameter:

  • 0 = Disabled (default)

  • 1 = Enabled

Temporarily enable Syslog in Kernel on a Security Gateway:

1. Run:

   #fwctlset int fwsyslog_enable 1

2. Install policy.

Permanently enable:

1. Run:

   echo fwsyslog_enable=1 >> $FWDIR/modules/fwkern.conf

2. Reboot the Security Gateway or cluster members.

Temporarily disable:

1. Run:

   #fwctlset int fwsyslog_enable 0

Permanently disable:

1. Edit $FWDIR/modules/fwkern.conf and set/remove the fwsyslog_enable line so it is disabled.

2. Reboot the Security Gateway.

Check Syslog in Kernel status:

[name@host:0] # fw ctl get int fwsyslog_enable

Sample output:

fwsyslog_nlogs_counter = 21

To see the log count for all instances:

1. Open two CLI connections to the Security Gateway.

2. On the first, run:

   #fwctlzdebug

3. On the second, run:

   #fwctlset size fwsyslog_print_counter 1

4. On the first shell, see the counter per instance and the sum.

---

Normalized Key-Value Pairs / Vendor Field Mapping

Any normalized log message contains indexed fields (key/value pairs) to allow fast indexed searches. Vendor Field mapping tables show which vendor fields map to which Logpoint fields. Mapping depends on the normalizer used.

CheckPointOpsecCompiledNormalizer mapping

The following table maps Check Point Firewall fields to Logpoint taxonomy (excerpt):

Check Point Firewall Fields	LogPoint Fields
app_category	category
app_desc	description
app_id	application_id
bytes	datasize
d_port	destination_port
dst	destination_address
dst_machine_name	server
dst_user_name	target_user
generated_time	log_ts
i/f_name	source_interface
icmp-code	icmp_code
message_info	message
NAT_rulenum	nat_rule_number
orig	host_address
policy_name	policy
proto	protocol
s_port	source_port
service	destination_port
src	source_address
src_user_name	user
start_time	start_ts
time	log_ts
User	user
web_client_type	user_agent
xlatedport	nat_destination_port
product	application
received_bytes	received_datasize
sent_bytes	sent_datasize
has_accounting	accounting_flag
logId	log_id
log_sequence_num	sequence_number
browse_time	browse_duration
Suppressed logs	suppressed_log_count
LastUpdateTime	last_update_ts

(See full mapping in original documentation for all fields.)

CheckPointFirewallCEFCompiledNormalizer mapping

The following table maps Check Point Firewall fields to Logpoint taxonomy (excerpt):

Check Point Firewall Fields	LogPoint Fields
app_category	category
app_desc	description
app_id	application_id
bytes	sent_datasize
d_port	destination_port
dst	destination_address
dst_machine_name	server
endpoint_ip	endpoint_address
generated_time	log_ts
icmp-type	icmp_type
message_info	message
NAT_rulenum	nat_rule_number
orig	host_address
policy_name	policy
proto	protocol_id
s_port	source_port
service	destination_port
src	source_address
start_time	start_ts
time	log_ts
xlatedport	nat_destination_port
assigned_ip	new_address
attack_info	attack_information
auth_method	authentication_method
auth_status	status
client_name	event_source
client_version	application_version
cookiei	cookie_i
domain_name	domain
feature_name	feature
flags	flag
origin	gateway_address
outzone	destination_zone
peer_gateway	peer_address
product	application
protection_name	protection
sam_log_type	event_type
sam_rule_uid	sam_rule_id
src_machine_group	machine_group
src_user_group	group
seqencenum	sequence_number
termination_reason	reason
vpn_feature_name	vpn_feature
logid	log_id

(See full mapping in original documentation for all fields.)

CheckPointFirewallCEFCompiledNormalizer (alternate mapping)

Another CEF-based mapping (excerpt):

Check Point Firewall Fields	LogPoint Fields
deviceExternalId	serialnumber
src	sourceaddress
dst	destinationaddress
sourceTranslatedAddress	natsourceaddress
destinationTranslatedAddress	natdestinationaddress
Rule	rule
suser	user
duser	targetuser
app	application
VirtualSystem	virtualfirewall
SourceZone	sourcezone
DestinationZone	destinationzone
deviceInboundInterface	sourceinterface
deviceOutboundInterface	destinationinterface
LogProfile	logprofile
SessionID	sessionid
cnt	eventcount
spt	sourceport
dpt	destinationport
Flags	flag
proto	protocol
act	action
msg	message
URLCategory	urlcategory
deviceDirection	direction
Totalbytes	datasize
Packets	packetcount
Elapsedtimeinseconds	duration
sequencenum	sequencenumber
rt	logts
start	startts
originsicname	path
conndirection	direction
destinationDnsDomain	destinationdomain
deviceMacAddress	hardwareaddress
deviceNtDomain	windowsdomain
deviceProcessName	processid
dhost	destinationhost
dmac	destinationhardwareaddress
dpid	destinationprocessid
duser	targetuser
dvchost	host
end	endts
fileHash	hash
filePath	path
out	sentdatasize
outcome	outcome
request	url
requestMethod	requestmethod
shost	sourcehost
smac	sourcehardwareaddress
spt	sourceport
src	sourceaddress
start	startts
bytes	datasize
packets	packet
origin	hostaddress
logid	logid
loguid	loguid
ifname	interface
clientinboundpackets	receivedpacket
clientoutboundpackets	sentpacket
serverinboundbytes	serverreceiveddatasize
serveroutboundbytes	serversentdatasize

(See full mapping in original documentation for all fields.)

---

CheckPoint Firewall Labels

Labels are key-value pairs assigned to log fields after parsing, used to categorize, enrich, and structure logs. Logpoint applies labels via:

• Label Packages

• Normalization Signatures

• Labeling Rules

Checkpoint Firewall has two Label Packages:

• LP_CheckPoint Firewall

• LP_CheckPoint Firewall OpsecL

Adding / Activating Label Packages:

1. Go to Settings >> Knowledge Base and click Label Packages.

2. Under Vendor Label Packages, click the Activate Label Package icon.

3. Click Manage Labels to view Search Labels.

CheckPoint Action → Label Mapping

The labels assigned to logs according to the value of the action field:

ACTION	LABEL
accept	Connection, Allow
ctl	Connection, Control
monitor	Connection, Monitor
drop	Connection, Deny, Drop
reject	Connection, Deny
decrypt	Connection, Decrypt
block	Connection, Deny
encrypt	Connection, Encrypt
log in	User, LogIn
update	Connection, Update
log out	User, LogOut, Logoff
ip changed	IP, Change
key install	Key, Install

---

Expected Log Sample

Pipe (|) separated key-value pair example:

loc=18308544|time=2017-03-29 09:09:59|action=accept|orig=1.1.1.1|i/f_dir=inbound|i/f_name=bond1|has_accounting=0|uuid=<00000000,00000000,00000000,00000000>|product=VPN-1 & FireWall-1 (Admin Login)|rule=154|rule_uid={FA93543F-660F-45E7-BE29-66941FA83065}|rule_name=Acces LAN Server|src=192.xxx.x.xxx|s_port=50332|dst=192.xxx.x.xx|service=8443|proto=tcp|user=John Doe(John.Doe)(+)|src_user_name=John Doe (John.Doe)(+)|[email protected]|snid=11111111|__policy_id_tag=product=VPN-1 & FireWall-1[db_tag={065CA417-2FAD-D442-ABF7-5C6286BD8F25};mgmt=management;date=1485270831;policy_name=FW-BACK-BACALAN]|origin_sic_name=CN=fw-bacalan01,O=management.logpoint.com

---

We do our best to ensure that the content provided is complete and up to date. Logpoint makes no warranties about the documentation. We update it on a best-effort basis.