Threat Level: green Handler on Duty: Rob VandenBrink

SANS ISC: Dshield submissions aren't working if you have a Checkpoint Firewall - Internet Security | DShield SANS ISC InfoSec Forums


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Dshield submissions aren't working if you have a Checkpoint Firewall

Checkpoint Firewalls have a feature to be able submit logs directly to Dshield.  Well...  they are supposed to.

Turns out there is an issue with Checkpoint's submission process, and (as far as I know) you will not get any indication that you are not submitting logs to us.  We appreciate it when our readers submit logs into Dshield, and thusly the Internet Storm Center.  If you are trying to submit logs to us, and would like it to be native, that'd be great, however, right now, the feature isn't working. 

So, in the meantime while several of our readers have called Checkpoint support to ask that they fix this issue, please check out http://www.dshield.org/howto.html in order to submit your logs.  There is a module ready for Checkpoint, outside of the actual firewall software itself, and we'd love to have your logs.  Thanks!

-- Joel Esler http://www.joelesler.net

Joel

454 Posts
ISC Handler
I had got around this by installing sendmail rpms on the SPLAT device and using the older fw1-41 scripts, but it was a real PITA finding them and then making sure that all the dependencies were satisfied. I had to install Perl as well, of course. But then we upgraded and it all went away :(. Ever since then I've just not been submitting them. Sigh.
Anonymous
Posts

Sign Up for Free or Log In to start participating in the conversation!