Follow these steps:

1. Connect with SmartDashboard to Security Management Server / Domain Management Server.
   
   

2. Create a new Security Gateway object for the appliance:

   1. In Network Objects, right-click on Check Point - go to Check Point - click on Security Gateway/Management...:

      
      
      

   2. Select Wizard Mode:

      
      
      

   3. On the General Properties page:

      1. Enter Gateway Name exactly as it is on the GW 
      2. In Gateway platform, select "Other"
      3. Enter Gateway IP address
      4. Click on Next

      Example:

      
      
      

   4. On the Trusted Communication page, select Skip and initiate trusted communication later - click on "Next":

      
      
      
   5. Click on "Finish".
      
      

   6. Click on "Save" to save the changes (or go to File menu - click on Save).

      Example:

      
      
      
   7. The new Gateway object should appear in Network Objects.
   
   
   

3. Open the appliance's object - click on Communication...:

   1. Select platform Small Office Appliance
      
      
   2. Select "Initiate trusted communication securely by using a one-time password"
      
      
   3. Select "Initiate trusted communication automatically when the Gateway connects to the Security Management server for the first time"
      
      
   4. Click on "OK"

   Example:

   
   
   
4. Save the changes (go to File menu - click on Save).
   
   

5. Get the Management Server's SIC name:

   1. Connect to the command line on the Security Management Server / Multi-Domain Security Management Server.
      
      
   2. Login to Expert mode.
      
      

   3. On the Multi-Domain Security Management Server, switch to the context of the involved Domain Management Server:

      [Expert@HostName:0]# mdsenv <Name of Domain Management Server>
      
      

   4. Get the SIC name:

      [Expert@HostName:0]# $CPDIR/bin/cpprod_util CPPROD_GetValue SIC MySICname 0

      Copy the entire string.

      Example output:

      cn=cp_mgmt,o=My_MGMT-1..gugcq3

6. Configure the External Security Log Server in the appliance's WebUI:

   1. Connect to the appliance's WebUI and log in.
      
      
   2. Go to Logs & Monitoring tab - in the left pane, click on Log Servers
      
      
   3. In the " External Security Log Server - not configured" line, click on Configure...
      
      

   4. Configure the External Security Log Server:

      1. Enter the IP address of the Security Management Server / Domain Management Server.
      2. Enter the Management Server's SIC name.
      3. Enter the SIC password.
      4. Click on Apply.

      Example:

      
      
      

   5. A message should appear in SmartDashboard that SIC was established with the appliance.

      Example:

      
   
   
   

7. Connect with SmartView Tracker to the Security Management Server / Domain Management Server and verify that logs are received from the appliance.

   Example:

   

Troubleshooting:

If the connection between the GW and the MGMT Server does not succedded, we may get the following error on the GW:

Unable to connect to Log Server. Exit Code 1

What to check:

Run CPCA debug on the MGMT server: #fw debug cpca on TDERROR_ALL_ALL=5 ;

Run  #tail -f $FWDIR/log/cpca.elg ;

Try to search for : "...common name is missing in dn" that states that the GW name/certificate is not the same/invalid. 

Try to fix it by reinitialize the GW Internal CA and to create a GW object with the same name as the physical GW.

Verify that the Gateway object name is now identical to the name that is configured on the physical Gateway.

Reinitialize the SIC between the locally managed gateway and the management server.

In the MGMT, check the CPCA debug again and look for "... cert status is now valid ".

Turn of the debug: fw debug cpca off RDERROR_ALL_ALL=0 ;