> Source: [sk107509](https://support.checkpoint.com/results/sk/sk107509) # sk107509 - How to connect a Check Point Management Server and an RSA SecureAnalytics Server via OPSEC-LEA | Property | Value | |----------|-------| | Solution ID | sk107509 | | Date Created | 2015-09-10 | | Last Modified | 2017-10-09 | | Technical Level | General | | Products | Security Management Server | | Versions | R82.10, R82, R81.20 | ## Solution Introduction: ------------- 1. Collect the correct DN for the Security Management server /Domain / CMA and the Log Server / CLM by running the following on the Security Management server / Multi-Domain Management server (MDS): 1. On MDS, run: *mdsenv \* 2. Run: #*cpca_client lscert -stat Valid -kind SIC* 3. Look for the certificate bearing the object name of the Log Server / CLM and the certificate with a DN that begins "*CN=cp_mgmt..* ." 4. Copy and paste the DN's from these certificates verbatim to a plain text file.

2. Determine if there are any other OPSEC-LEA clients that connect to the Security Management Server / CMA or the Log Server / CLM, including SmartEvent or SmartReporter, as we only support one client connecting to the*lea_server auth_port.* If there are other clients connecting to this port, they will need to be moved to another port using clear text as RSA SecureAnalytics only supports SSLCA *auth_port* connections. Configuration ------------- 1. In SmartConsole, create and configure a Host object that represents the RSA Secure Analytics Server. 2. Configure an OPSEC Application for the RSA SecureAnalytics server as follows: 1. In SmartConsole, click Objects list, then select ***More Object types -\> Server -\> OPSEC Application -\> New Application...*** ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk107509/sk107509-11710090703.png) 2. Enter a name for the application (this is the name you will use in your SecureAnalytics configuration for the client name.) 3. Select the node object you created in the previous step as the host 4. Select the LEA and CPMI client entities, leaving all other entities, both server and client, unchecked. ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk107509/sk107509-21710090709.png) 5. On the LEA permissions tab, select the option that meets your security needs. The default is "Show all log fields". 6. On the CPMI Permissions tab, select the correct permissions desired. The default is "Administrator's Credentials". 7. On the General Tab, click Communications. 8. Enter the one-time user password that the RSA SecureAnalytics Client will use to pull its Certificate. 9. Click the Initialize button and close the communications window by clicking Close. 10. Copy the DN now listed next to the Communication Button and past e into the same plain text file as the other DN's 11. Click OK to finalize the OPSEC Application
3. Save the configuration and distribute the new object to all affected servers: 1. In SmartConsole, click Save 2. Distribute the new object to all affected Management and Log servers by selecting Policy -\> Install Database from the menu bar or Launch Menu. 3. Verify that only the effected devices are selected and then press ok to install database to those devices. Wait until the process completes successfully for all selected devices.

4. Configure the RSA SecureAnalytics Server according to the developer's instructions for the Security Management server / CMA: 1. Disable the new encoder 2. Client Name: Use the name selected for the OPSEC Application 3. Client DN: Use the DN copied from the OPSEC Application 4. Server DN: Use the DN that begins "*CN=cp_mgmt.* ." 5. Under Advanced, select "Security Logs" for the Log Type 6. Pull the certificate for the server by selecting this option and entering the one-time use password selected earlier. 7. Configure Advanced settings as required to collect the desired information from the Security Management server / CMA. 8. Click OK to pull the certificate 9. Reopen the new encoder, select the certificate that was added with the certificate pull. 10. Enable the encoder and verify functionality.

5. (Optional) If using a Log Server / CLM for Firewall logs, follow the previous process for configuring the Security Management server / CMA with the following changes: * Server DN: Use the DN for the Log Server / CLM collected from the Internal Certificate Authority.

6. (Optional) If audit logs are also desired, create a second encoder for each device, specifying "Audit Logs" for the Log Type. Troubleshooting --------------- 1. For traffic monitoring, run: *tcpdump �nni \ host \ and port \* Where: *\* is the name of the interface the traffic to the peer server would depart through. *\* is the IP address of the peer server rather than the local server *\* is the destination port of the client communications, typically port 18184. 2. To debug the FWD process, run * *cpstop* (or for MDS: *mdsstop_customer \* ) * on MDS/MLM, run:*mdsenv \* * *rm $FWDIR/log/fwd.elg\** * *cpstart* (or for MDS:*mdsstart_customer \* ) * *fw debug fwd on TDERROR_ALL_ALL=5* * Enable and then disable the encoder that has the problem * Run:*fw debug fwd off* * Search the resultant files for lines containing "*lea_server_init_permissions*" and verify that the connection initialization was captured in the debugs.

3. Contact RSA Support for further debugs to run on the SecureAnalytics Server. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content