topic Re: Checkpoint LEA clear text connection with Checkpoint Add-on in All Apps and Add-ons

Checkpoint LEA clear text connection with Checkpoint Add-on

simonhon — Thu, 14 Nov 2013 03:45:01 GMT

Hi All,

Would there be any suggestion for us to resolve a problem between Splunk and checkpoint.
Currently, there is existing log management (not Splunk) using clear text connection with Checkpoint, and we are in the stage to adding new log tool (i.e. Splunk) while we found that it is only documented in Checkpoint Add-on for sslca or ssl_opsec connection in Splunk.

Do you have any idea for configuring Splunk with clear text configuration in Checkpoint device?

Thanks a lot.
Simon

Re: Checkpoint LEA clear text connection with Checkpoint Add-on

rroussev_splunk — Wed, 04 Dec 2013 20:02:59 GMT

The checkpoint article sk32521 describes how to setup clear connections, though we don't officially support it.

Re: Checkpoint LEA clear text connection with Checkpoint Add-on

ccheung_splunk — Tue, 11 Feb 2014 19:42:30 GMT

If your checkpoint is using sslca_clear, you can manually change your opsec.conf attribute of an existing connection to the following and it should work.

lea_server_auth_type = sslca_clear

Re: Checkpoint LEA clear text connection with Checkpoint Add-on

aakwah — Tue, 29 Sep 2020 13:48:34 GMT

I am using OPSEC LEA version 4.1.0 and setting lea_server_auth_type to sslca_clear is not working.