Follow these steps:

1. Connect with SmartDashboard to the Security Management Server / Domain Management Server.

2. Create a new Security Gateway object for the appliance:

   1. In Network Objects, right-click on Check Point - go to Check Point - click on Security Gateway/Management...:

      
      
      

   2. Select Wizard Mode:

      
      
      

   3. On the General Properties page:

      1. Enter the Gateway Name exactly as it is on the Gateway.
      2. In Gateway platform, select "Other".
      3. Enter Gateway IP address.
      4. Click on Next.

      Example:

      
      
      

   4. On the Trusted Communication page, select Skip and initiate trusted communication later - click on "Next":

      
      
      
   5. Click on "Finish".

   6. Click on "Save" to save the changes (or go to File menu - click on Save).

      Example:

      
      
      
   7. The new Gateway object should appear in Network Objects.

3. Open the appliance's object - click on Communication...:

   1. Select platform Small Office Appliance  
      
      
   2. Select "Initiate trusted communication securely by using a one-time password".
      
      
   3. Select "Initiate trusted communication automatically when the Gateway connects to the Security Management server for the first time".
      
      
   4. Click on "OK".

   Example:

   
   
   
4. Save the changes (go to File menu - click on Save).

5. Get the Management Server's SIC name:

   1. Connect to the command line on the Security Management Server / Multi-Domain Security Management Server.
      
      
   2. Login to Expert mode.

   3. On the Multi-Domain Security Management Server, switch to the context of the involved Domain Management Server:

      [Expert@HostName:0]# mdsenv <Name of Domain Management Server>

   4. Get the SIC name:

      [Expert@HostName:0]# $CPDIR/bin/cpprod_util CPPROD_GetValue SIC MySICname 0

      Copy the entire string.

      Example output:

      cn=cp_mgmt,o=My_MGMT-1..gugcq3

6. Configure the External Security Log Server in the appliance's WebUI:

   1. Connect to the appliance's WebUI and log in.
      
      
   2. Go to the Logs & Monitoring tab - in the left pane, click on Log Servers
      
      
   3. In the "External Security Log Server - not configured" line, click on Configure...

   4. Configure the External Security Log Server:

      1. Enter the IP address of the Security Management Server / Domain Management Server.
      2. Enter the Management Server's SIC name.
      3. Enter the SIC password.
      4. Click on Apply.

      Example:

      
      
      

   5. A message should appear in SmartDashboard that SIC was established with the appliance.

      Example:

      

7. Install database (go to File menu - click on Install database)

8. Connect with SmartView Tracker to the Security Management Server / Domain Management Server and verify that logs are received from the appliance.

   Example:

   

 

Troubleshooting:

If the connection between the Gateway and the Management Server does not succeed, you may get the following error on the Gateway: Unable to connect to Log Server. Exit Code 1

What to check:

• Run CPCA debug on the Management Server: #fw debug cpca on TDERROR_ALL_ALL=5 ;
• Run #tail -f $FWDIR/log/cpca.elg ;
• Try to search for : "...common name is missing in dn" that states that the Gateway name/certificate is not the same/invalid. 
• Try to fix it by reinitializing the Gateway Internal CA and creating a Gateway object with the same name as the physical Gateway.
• Verify that the Gateway object name is now identical to the name that is configured on the physical Gateway.
• Reinitialize the SIC between the locally managed Gateway and the Management Server.
• In Management, check the CPCA debug again and look for "... cert status is now valid ".
• Turn off the debug: fw debug cpca off TDERROR_ALL_ALL=0 ;

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

This solution is about products that are no longer supported and it will not be updated