[FW-1] Sending log to externally managed management server

[Lindqvist Per <per.lindqvist@FW1-NOSPAMBTJ.SE>]

Hi list subscribers,

I have a Nokia IP120 at a remote site, running both a firewall and a
management module. To read the logs I have to connect to this management
server.

At my main site I have a faster/bigger (closer to my desktop) management
server serving two other firewall-only modules.

IP120 is running NG FP2, main site is running NG FP3. I'm trying to get
my IP120 to send logs, not only to itself, but also to my main
management.

At the IP120 I have made an Checkpoint->"Externally managed host" object
for my main management and added this object to the "Log servers" tab in
the gateway properties of the "IP120" object. This can also be verified
in the $FWDIR/conf/masters

I have created accept rules to allow FW1_log (port 257) at both sites. I
can see that the IP120 is sending logs to my main management (I'm
logging the connection at the main site) but the log from IP120 doesn't
turn up in the log for the main management server. They still are loged
at the IP120.

Any idea what could be wrong? Do I have to make a SIC trust between the
modules? Since the IP120 is both firewall and management the SIC
procedure doesn't show up in the cpconfig command. Also the SIC isn't
available in the GUI for externally managed objects.

TIA,
Per Lindqvist

=================================================
To set vacation, Out Of Office, or away messages,
send an email to LISTSERV@lists.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================