All Apps and Add-ons

Splunk Add-on for Check Point OPSEC LEA: Opsec error. rc=-1 err=-96 Connection error Checkpoint Add-on pull-cert

jgbricker
Contributor

I'm unable to get the certificate from the Check Point management server. I can successfully connect with nc -z <ip> <port> I've verified the ip and password. I have opened a case with Splunk support, but I wanted to see if any other assistance was available as I would like to resolve this quickly.

0 Karma
1 Solution

jgbricker
Contributor

I did a tcpdump at my heavy forwarder with the dst filter and found that I was just sending SYN packets without getting any further through the tcp convo. There was an issue with the ACL rules, and also the port 18210 had to be opened for the initial cert exchange.

View solution in original post

0 Karma

jgbricker
Contributor

I did a tcpdump at my heavy forwarder with the dst filter and found that I was just sending SYN packets without getting any further through the tcp convo. There was an issue with the ACL rules, and also the port 18210 had to be opened for the initial cert exchange.

0 Karma

Chubbybunny
Splunk Employee
Splunk Employee

we had a similar issue in:
https://answers.splunk.com/answers/89725/rc-1-err-96-connection-error-with-check-point-ospec-lea-app...

I believe we resolved it by assigning a hostname entry to our configured NIC's

0 Karma

jgbricker
Contributor

Yeah I was checking out that post. I can nc -z 18184

Would the mentioned hostname config be a possible issue if I'm not using host name in the connect param? By the way I do have a splunk case opened. 289923.

0 Karma

Chubbybunny
Splunk Employee
Splunk Employee

while port 18184/tcp is used to retrieve the FW/Audit logs from Check Point, you'll also need port 18210/tcp available to execute a one time "pull-cert" from the manager.

I believe we had added a static entry for each interface in /etc/hosts. Then used an IP address to connect with the manager to finalize the connection.

0 Karma
Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...