topic Re: Check Point Firewall Log Exporter_TLS Config in Splunk Enterprise

Check Point Firewall Log Exporter_TLS Config

notme — Thu, 14 Nov 2024 23:10:42 GMT

Hi,

I am deploying Splunk Enterprise and will eventually be forwarding Check Point Firewall logs using Check Point's Log Exporter. Check Point provides the option to select "Syslog" or "Splunk" as the log format (there are some other formats as well); I will choose "Splunk".

I need to know how to configure Splunk Enterprise to receive encrypted traffic from Check Point if I use TLS at the Check Point to send encrypted traffic to Splunk.

Can someone enlighten me on this please?

Thanks!

Re: Check Point Firewall Log Exporter_TLS Config

MuS — Fri, 15 Nov 2024 00:11:24 GMT

Hi there,

If I recall correct the Checkpoint only supports syslog over TCP and can therefore use TLS. Splunk syslog input only supports UDP and no SSL.

That said you could use a TCP input, configure TLS/SSL https://docs.splunk.com/Documentation/Splunk/8.2.7/Admin/Inputsconf and see what you can get.

Hope this helps ...

cheers, MuS

Re: Check Point Firewall Log Exporter_TLS Config

notme — Fri, 15 Nov 2024 11:10:15 GMT

Thanks @MuS!