Check Point Firewall Log Exporter_TLS Config

[notme]

Hi,

I am deploying Splunk Enterprise and will eventually be forwarding Check Point Firewall logs using Check Point's Log Exporter. Check Point provides the option to select "Syslog" or "Splunk" as the log format (there are some other formats as well); I will choose "Splunk".

I need to know how to configure Splunk Enterprise to receive encrypted traffic from Check Point if I use TLS at the Check Point to send encrypted traffic to Splunk.

Can someone enlighten me on this please?

Thanks!

[MuS]

Hi there,

If I recall correct the Checkpoint only supports syslog over TCP and can therefore use TLS. Splunk syslog input only supports UDP and no SSL.

That said you could use a TCP input, configure TLS/SSL https://docs.splunk.com/Documentation/Splunk/8.2.7/Admin/Inputsconf and see what you can get.

Hope this helps ...

cheers, MuS

[notme]

Thanks @MuS!