Adding a Separate LEA Interface

The interface for an LEA server is the actual log source for the Check Point system.

The Add LEA Interface tab lets you define an interface for an LEA server defined on the appliance. This interface is the actual log source for the Check Point system, and the interface IP address appears as the origin in LEA messages.

Complete the configuration options listed under. If the interface is on a separate Check Point log source from the LEA server, use this Add LEA Interface tab. If the interface is on the same Check Point log source as the LEA server, you would have defined the interface in the Add Firewalls & Interfaces section while adding the LEA server.

  • To add a new LEA Interface to the appliance, click Add New. The Add LEA Interface tab appears.
  • To modify an existing LEA Interface on the appliance, click the firewall's Name. Make the necessary changes using the Modify LEA Interface screen and click Update.
  • To remove Interfaces from the appliance, check the interface’s check box and then click Remove.

Procedure

  1. Select an LEA Server to associate with the interface.
  2. Select a firewall to associate with the interface.
  3. Type a Name for the interface.
  4. Type the Interface IP address.
  5. Type the Interface IP mask.
  6. For Enable, indicate whether to activate the interface. The default is Yes.
  7. For Trusted, indicate whether to flag the interface as secure. The default is No.
  8. For Log Origin, indicate whether the interface is the origin of the log message. The default is No. Typically the origin is the interface that is connected to the Check Point Management Station.
  9. (Optional) Type a Description for the interface.
  10. Click Add to add the interface.