cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
585
Views
0
Helpful
1
Replies

Checkpoint Firewall Management Server Lost Identity in MARS

thebigch1980
Level 1
Level 1

About a month ago, we added our Checkpoint firewall to MARS as well as the 2 Firewall agents who reported to the device. The devices were recognized and running properly.

At some point in the last week, the Checkpoint management server lost it's identity within MARS. Instead of being recognized as a Checkpoint device, the server is now considered a "Generic Router Version Unknown" via the Device Type.

The agent firewalls beneath this device still exist as desired, but MARS is no longer recording logs for the primary device.

I'm ready to remove and recreate the device, but I'm interested to figure out how this could have happened. Nothing in the Audit Trail points to any weird configuration changes.

I've posted a picture here: http://pixpin.com/viewer.php?file=mars-checkpoint-j1zc.jpg

1 Reply 1

htarra
Level 4
Level 4

It might have to do with bug CSCse03097 - CheckPoint LEA record comes to MARS later and later for better understanding

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: