Skip to content
Find out how we support MDR.

Page permalink

Always use the following permalink when referencing this page. It will remain unchanged in future help versions.

https://docs.sophos.com/central/customer/help/en-us/index.html?contextId=InfinityTotalProtection

Check Point Quantum Firewall

Log collector Firewall

You must have the Firewall integrations license pack to use this feature.

You can integrate Check Point Quantum Firewall with Sophos Central so that it sends audit data to Sophos for analysis.

This integration uses a log collector hosted on a virtual machine (VM). Together they're called an integration appliance. The appliance receives third-party data and sends it to the Sophos Data Lake.

This page describes integration using an appliance on ESXi or Hyper-V. If you want to integrate using an appliance on AWS, see Integrations on AWS.

Key steps

The key steps in integration are as follows:

  • Add an integration for this product. In this step, you create an image of your appliance.
  • Download and deploy the image on your VM. This becomes your appliance.
  • Configure Quantum Firewall to send data to the appliance.

Requirements

Appliances have system and network access requirements. To check that you meet them, see Appliance requirements.

Add an integration

To integrate Quantum Firewall with Sophos Central, do as follows:

  1. In Sophos Central, go to Threat Analysis Center > Integrations > Marketplace.

  2. Click Check Point Quantum Firewall.

    The Check Point Quantum Firewall page opens. You can add integrations here and see a list of any you've already added.

  3. In Data Ingest (Security Alerts), click Add Configuration.

    Note

    If this is the first integration you've added, we'll ask for details about your internal domains and IPs. See Provide your domain and IP details.

Configure the appliance

In Integration setup steps, you can configure a new appliance or use an existing one.

We assume here that you configure a new appliance. To do this, create an image as follows:

  1. Add a name and description for the new integration.
  2. Click Create new appliance.
  3. Enter a name and description for the appliance.
  4. Select the virtual platform. Currently we support VMware ESXi 6.7 Update 3 or later and Microsoft Hyper-V 6.0.6001.18016 (Windows Server 2016) or later.

  5. Specify the IP settings for the Internet-facing network ports. This sets up the management interface for the appliance.

    • Select DHCP to assign the IP address automatically.

      Note

      If you select DHCP, you must reserve the IP address.

    • Select Manual to specify network settings.

  6. Select the Syslog IP version and enter the Syslog IP address.

    You'll need this syslog IP address later, when you configure Quantum Firewall to send data to your appliance.

  7. Select a Protocol.

    You must use the same protocol when you configure Quantum Firewall to send data to your appliance.

  8. Click Save.

    We create the integration and it appears in your list.

    In the integration details, you can see the port number for the appliance. You'll need this later when you configure Quantum Firewall to send data to it.

    It might take a few minutes for the appliance image to be ready.

Deploy the appliance

Restriction

If you're using ESXi, the OVA file is verified with Sophos Central, so it can only be used once. If you have to deploy another VM, you must create an OVA file again in Sophos Central.

Use the image to deploy the appliance as follows:

  1. In the list of integrations, in Actions, click the download action for your platform, for example Download OVA for ESXi.
  2. When the image download finishes, deploy it on your VM. See Deploy appliances.

Configure Quantum Firewall

Now go to Quantum Firewall and configure the Check Point Log Exporter to send audit data to us.

Note

You can configure multiple instances of Quantum Firewall to send data to Sophos via the same appliance. After you finish integration, repeat the steps in this section for your other instances of Quantum Firewall. You don't need to repeat the steps in Sophos Central.

You can configure the Check Point Log Exporter using the command line interface (CLI), or the SmartConsole.

Use CLI

To configure Log Exporter using CLI commands, use the cp_log_export command on the log server.

The syntax is as follows:

cp_log_export add name <name> [domain-server <domain-server>] target-server <target-server IP/host name> target-port <target-port> protocol <(udp|tcp)> format <(cef)|(syslog)> [optional arguments]

  1. Before you run the command, configure it with the following information:

    • In MDS or MLM mode the domain-server argument is required. Configure it as follows:

      • Use mds as the value for domain-server to export MDS level audit logs.
      • Use all as the value for domain-server to configure the integration on every domain.

    • The domain-server IP address or name configures the integration on a specific domain. Target-server can use the IP address or DNS name.

      This creates a new target directory with the unique name specified in name, under $EXPORTERDIR/targets/<deployment_name>.

    • Set the following target-server parameters to the connection details for your Sophos appliance:

      • IP Address
      • Port

      • Protocol

        You must enter the same IP address, port and protocol settings you entered in Sophos Central when you added the integration.

    • Set format to cef.

  2. Run the add name command.

  3. To start the new log exporter with the new parameters run cp_log_export restart. It doesn't start automatically.

For more details on the cp_log_export command, see Log Exporter - Basic Deployment.

Your Quantum Firewall data should appear in the Sophos Data Lake after validation.

Use SmartConsole

To configure Log Exporter using SmartConsole, see the Check Point Logging and Monitoring Administration Guide. See Logging and Monitoring Administration Guide.