Getting Data In

How to deploy Check Point OPSEC LEA on several heavy fowarder servers?

sassens1
Path Finder

Hello,

I have a couple of heavy forwaders running but only one with Checkpoint LEA 3.1 TA installed.
Thus in case of failover I'll loose all log grabbing from my Checkpoint CMA's.
But if I install the TA on each heavy forwarder with the same config I'll have multiple checkpoint logs entries.

How can setup a resilient installation of the opsec-lea TA accross mutliple forwarders?
Note: I plan to updgrade to v4.1 but I don't see any difference in the log collecting process.

0 Karma

javiergn
SplunkTrust
SplunkTrust

Hi,

Short answer based on my experience with OPSEC LEA 3.1: it's evil.

Even if you have the TA deployed on each HF with the same config, how do you sync them all so that they all know where to start to read from and you don't end up with duplicates or gaps?

Your best bet as far as I can tell would be to use Virtual Machines for that heavy forwarder and rely on whichever resiliency your VM team can provide: VM snapshots, backups, etc. Keep in mind your logs are stored in your CheckPoint CMAs for quite some time (depending on your configuration) so if a VM is unavailable for 1-2 hours it shouldn't be a massive disaster.

I don't know if v4.1 solves this problem as I'm not planning to upgrade any time soon.

Sorry it's probably not the answer you were looking. Maybe others can share their own experiences and help you a bit more.

Thanks,
J

Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...