topic Re: Splunk Add-on for Check Point OPSEC LEA: Opsec error. rc=-1 err=-96 Connection error Checkpoint Add-on pull-cert in All Apps and Add-ons

Splunk Add-on for Check Point OPSEC LEA: Opsec error. rc=-1 err=-96 Connection error Checkpoint Add-on pull-cert

jgbricker — Wed, 18 Nov 2015 20:39:38 GMT

I'm unable to get the certificate from the Check Point management server. I can successfully connect with nc -z <ip> <port> I've verified the ip and password. I have opened a case with Splunk support, but I wanted to see if any other assistance was available as I would like to resolve this quickly.

Re: Splunk Add-on for Check Point OPSEC LEA: Opsec error. rc=-1 err=-96 Connection error Checkpoint Add-on pull-cert

Chubbybunny — Wed, 18 Nov 2015 20:46:51 GMT

I believe we resolved it by assigning a hostname entry to our configured NIC's

Re: Splunk Add-on for Check Point OPSEC LEA: Opsec error. rc=-1 err=-96 Connection error Checkpoint Add-on pull-cert

jgbricker — Wed, 18 Nov 2015 21:16:49 GMT

Yeah I was checking out that post. I can nc -z 18184

Would the mentioned hostname config be a possible issue if I'm not using host name in the connect param? By the way I do have a splunk case opened. 289923.

Re: Splunk Add-on for Check Point OPSEC LEA: Opsec error. rc=-1 err=-96 Connection error Checkpoint Add-on pull-cert

Chubbybunny — Wed, 18 Nov 2015 21:29:58 GMT

while port 18184/tcp is used to retrieve the FW/Audit logs from Check Point, you'll also need port 18210/tcp available to execute a one time "pull-cert" from the manager.

I believe we had added a static entry for each interface in /etc/hosts. Then used an IP address to connect with the manager to finalize the connection.

Re: Splunk Add-on for Check Point OPSEC LEA: Opsec error. rc=-1 err=-96 Connection error Checkpoint Add-on pull-cert

jgbricker — Fri, 22 Jan 2016 12:26:35 GMT

I did a tcpdump at my heavy forwarder with the dst filter and found that I was just sending SYN packets without getting any further through the tcp convo. There was an issue with the ACL rules, and also the port 18210 had to be opened for the initial cert exchange.