Skyline Configuration on Quantum Spark Appliances

Configuring a Prometheus Server

1. Mandatory: On the Prometheus Server, enable its Remote Write Receiver to get metrics data from the Check Point Servers. Refer to these Prometheus instructions.

2. Optional: Use TLS Encryption and Basic authentication to secure the connection between the Prometheus Server and the OpenTelemetry Collector.

   Instructions

   The Prometheus Server and OpenTelemetry Collector support Transport Layer Security (TLS) encryption for their connection. Refer to these Prometheus instructions.

   Check Point also requires you to enable basic authentication to make the security bi-directional, refer to these Prometheus instructions.

   TLS configuration has two main components:

   • A pair of a Key and a Certificate, used to encrypt your communication.

   • (Optional) Certificate Authority (CA) that you trust, used to verify and trust the certificate of the other endpoint with which you communicate. If the certificate of the other endpoint is unknown to the CA, the communication is rejected.

   You can create these certificates:

   • CA-signed certificates: You create a key and a certificate request, which is then signed by the CA.

   • Self-signed certificates: You create a key and a certificate that is signed by the user.

   The steps below describe a self-signed certificate.

   To configure TLS, you must create two pairs of a key and a certificate on the Prometheus Server:

   1. Create a self-signed certificate and a private key on the Prometheus Server:

      1. Create the file called openssl.conf with the template below.

         Enter the applicable information in the "[ dn ]" and "[ alt_names ]" sections.

         Important - The Prometheus Server and the OpenTelemetry Collector must have different hostnames and IP addresses.

         Template:

         [ req ] default_bits = 4096 default_md = sha256 req_extensions = v3_req distinguished_name = dn prompt = no [ v3_req ] subjectAltName = @alt_names [ dn ] C = <Country Name> ST = <State Or Province Name> L = <Locality> O = <Organization> OU = <Organization Unit> CN = <Common Name> [ alt_names ] DNS = <HOSTNAME> IP = <IP ADDRESS>

      2. Generate the key and certificate pair on any Gaia OS server (in the Expert mode):

         cpopenssl req -x509 -newkey rsa:4096 -nodes -config openssl.conf -keyout mykey.key -out mycert.crt -extensions v3_req

         This command creates two files in the current working directory:

         • mykey.key

         • mycert.crt

         Move these two files from the Gaia OS server to the Prometheus Server.

   2. Use the newly generated key and certificate file to configure TLS on the Prometheus Server in the web-config.yaml configuration file (you may need to create this file).

      Example of a web-config.yaml file:

      tls_server_config: key_file: /home/admin/mykey.key cert_file: /home/admin/mycert.crt

Configuring a Grafana Server (connecting Data-source and Dashboards)

1. Log in to Grafana and add a new Prometheus Data Source with the Prometheus Server you created.

   On the side panel, click Configuration > Data sources > click the Add data source button > select the Prometheus data source.

   Make sure to mark the Prometheus data source as Default.

   Example:

   

2. Import the Check Point Grafana dashboard to start monitoring your environment.

   On the side panel, click Create > Import > upload the applicable JSON file for a dashboard.

   Example:

   

3. You can modify the existing dashboards or create new dashboards according to your needs.

   To see a full description of all the data exposed by Skyline, see Skyline Metrics Repository.

   Example:

   

The Quantum Spark Appliance must be connected to the Internet.

If the Quantum Spark Appliance is connected to the Internet and you enable the Skyline feature, then:

• The appliance automatically downloads the OpenTelemetry Agent (OtlpAgent) and the OpenTelemetry Collector (CPotelcol) packages.

• The appliance automatically downloads the latest version of the OpenTelemetry Agent package each night.

1. From the left navigation panel, click Logs & Monitoring.

2. In the Diagnostics section, click the OpenTelemetry page.

3. Select Monitor this appliance using OpenTelemetry.

4. In the URL field, enter the full path of the receiver endpoint on your monitoring server.

   Example:

   https://192.168.33.44:9090/api/v1/write

5. Optional: In the Client Authentication section, enter the username and password to connect to your monitoring server.

6. Optional: In the Server Authentication section, upload the CA certificate of your monitoring server:

   1. Click Upload.

   2. Click Browse.

   3. Select the certificate file and click Open.

   4. Click Preview CA details to examine the certificate and click Close.

   5. Click Save.

7. Optional: Click Test Connection to make sure the correct server and credentials were entered.

8. In the bottom right corner of this page, click Save.