Connecting R80.30 SmartEvent to R80.30 Multi-Domain Server

You can configure a dedicated R80.30 server for SmartEvent components, and connect them to one or more Domains in an R80.30 Multi-Domain Security Management environment.

This procedure explains how to configure a dedicated server for these SmartEvent components:

• SmartEvent Server and SmartEvent Correlation Unit

Notes:

• In R80 Multi-Domain Security Management environment, you can only define the SmartEvent Server and SmartEvent Correlation Units at the global level and not the domain level.
• Configure SmartEvent to read logs from one domain or a number of domains.

To connect R80.30 SmartEvent Server and SmartEvent Correlation Unit to an R80.30 Multi-Domain Server:

1. Open SmartConsole.
2. Log in to the Global Domain:
   • In the SmartConsole login window, enter the Multi-Domain Server IP address or host name.
   • Select the Global Domain from the list (\Global).
3. Create a Check Point Host object for SmartEvent R80.
4. In the Check Point Host > Management, select these Management Blades:
   • Logging & Status
   • SmartEvent Server
   • SmartEvent Correlation Unit
5. Initialize SIC with the new SmartEvent R80.30 Server.
6. Click OK.
7. Click Publish.
8. Reassign the Global Policy for the Domains that use SmartEvent. For new Domains, create a new global assignment.
9. In each Domain Management Server, open SmartConsole.
10. Click Menu > Install Database , on each Domain Management Server and Domain Log Servers.
11. Wait until the server synchronizes and loads SmartEvent process.

See also Advanced Configuration for a dedicated SmartEvent Server that is also a Correlation Unit.

Note - For R77.30 Gateways and lower: activate the firewall session for the network activity report.