Checkpoint LEA clear text connection with Checkpoint Add-on

[simonhon]

Hi All,

Would there be any suggestion for us to resolve a problem between Splunk and checkpoint.
Currently, there is existing log management (not Splunk) using clear text connection with Checkpoint, and we are in the stage to adding new log tool (i.e. Splunk) while we found that it is only documented in Checkpoint Add-on for sslca or ssl_opsec connection in Splunk.

Do you have any idea for configuring Splunk with clear text configuration in Checkpoint device?

Thanks a lot.
Simon

[ccheung_splunk]

If your checkpoint is using sslca_clear, you can manually change your opsec.conf attribute of an existing connection to the following and it should work.

lea_server_auth_type = sslca_clear

[aakwah]

I am using OPSEC LEA version 4.1.0 and setting lea_server_auth_type to sslca_clear is not working.

[rroussev_splunk · Accepted solution]

The checkpoint article sk32521 describes how to setup clear connections, though we don't officially support it.