Follow these steps:

1. Connect with SmartDashboard to the Security Management Server / Domain Management Server.

2. Create a new Security Gateway object for the appliance:

   1. In Network Objects, right-click on Check Point - go to Check Point - click on Security Gateway/Management...:

      
      
      

   2. Select Wizard Mode:

      
      
      

   3. On the General Properties page:

      1. Enter the Gateway Name exactly as it is on the Gateway.
      2. In Gateway platform, select "Other".
      3. Enter Gateway IP address.
      4. Click on Next.

      Example:

      
      
      

   4. On the Trusted Communication page, select Skip and initiate trusted communication later - click on "Next":

      
      
      
   5. Click on "Finish".

   6. Click on "Save" to save the changes (or go to File menu - click on Save).

      Example:

      
      
      
   7. The new Gateway object should appear in Network Objects.

3. Open the appliance's object - click on Communication...:

   1. Select platform Small Office Appliance  
      
      
   2. Select "Initiate trusted communication securely by using a one-time password".
      
      
   3. Select "Initiate trusted communication automatically when the Gateway connects to the Security Management server for the first time".
      
      
   4. Click on "OK".

   Example:

   
   
   
4. Save the changes (go to File menu - click on Save).

5. Get the Management Server's SIC name:

   1. Connect to the command line on the Security Management Server / Multi-Domain Security Management Server.
      
      
   2. Login to Expert mode.

   3. On the Multi-Domain Security Management Server, switch to the context of the involved Domain Management Server:

      [Expert@HostName:0]# mdsenv <Name of Domain Management Server>

   4. Get the SIC name:

      [Expert@HostName:0]# $CPDIR/bin/cpprod_util CPPROD_GetValue SIC MySICname 0

      Copy the entire string.

      Example output:

      cn=cp_mgmt,o=My_MGMT-1..gugcq3

6. Configure the External Security Log Server in the appliance's WebUI:

   1. Connect to the appliance's WebUI and log in.
      
      
   2. Go to the Logs & Monitoring tab - in the left pane, click on Log Servers
      
      
   3. In the "External Security Log Server - not configured" line, click on Configure...

   4. Configure the External Security Log Server:

      1. Enter the IP address of the Security Management Server / Domain Management Server.
      2. Enter the Management Server's SIC name.
      3. Enter the SIC password.
      4. Click on Apply.

      Example:

      
      
      

   5. A message should appear in SmartDashboard that SIC was established with the appliance.

      Example:

      

7. Install database (go to File menu - click on Install database)

8. Connect with SmartView Tracker to the Security Management Server / Domain Management Server and verify that logs are received from the appliance.

   Example:

   

 

Troubleshooting:

If the connection between the Gateway and the Management Server does not succeed, you may get the following error on the Gateway:

Unable to connect to Log Server. Exit Code 1

What to check:

• Run CPCA debug on the Management Server: #fw debug cpca on TDERROR_ALL_ALL=5 ;
• Run #tail -f $FWDIR/log/cpca.elg ;
• Try to search for : "...common name is missing in dn" that states that the Gateway name/certificate is not the same/invalid. 
• Try to fix it by reinitializing the Gateway Internal CA and creating a Gateway object with the same name as the physical Gateway.
• Verify that the Gateway object name is now identical to the name that is configured on the physical Gateway.
• Reinitialize the SIC between the locally managed Gateway and the Management Server.
• In Management, check the CPCA debug again and look for "... cert status is now valid ".
• Turn of the debug: fw debug cpca off RDERROR_ALL_ALL=0 ;

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.