Connecting R80.30 SmartEvent to R77.xx Security Management Server

This procedure explains how to configure a dedicated server for these components:

• SmartEvent Server and SmartEvent Correlation Unit

To connect R80.30 SmartEvent Server and SmartEvent Correlation Unit to an R77.xx Security Management Server:

1. Open an SSH connection to the SmartEvent Server.
2. Run this script:
   $RTDIR/scripts/SmartEvent_R80_change_dbsync_mode.sh
3. Wait until the script has finished running. This is when cpstart has finished and you have a prompt.
4. Run: cpconfig
5. Select (2) Administrator to configure the SmartEvent Server administrators.

   Note – Administrators that are configured in R77.xx SmartConsole cannot manage the R80.30 SmartEvent Server.

6. Open the R77.xx SmartDashboard.
7. In SmartDashboard, create a Check Point Host object for the SmartEvent Server R80.30.
8. Create an SIC trust between the Security Management Server and the new server for SmartEvent R80.30.
9. Define it with the highest version available and ignore the Warning message.
10. For a dedicated SmartEvent Correlation Unit that is not a SmartEvent Server: In the Logs page, click Enable SmartLog.
11. In the Check Point Host > Management tab, enable these Software Blades:
    • Logging & Status
    • SmartEvent Server
    • SmartEvent Correlation Unit
12. Click OK.
13. Click Menu > Policy > Install Database.
14. Wait until the server synchronizes and loads SmartEvent

See also Advanced Configuration for a dedicated SmartEvent Server that is also a Correlation Unit.

Note - For R77.30 Gateways and lower: activate the firewall session for the network activity report.