CloudGuard Controller for Nozomi Networks Server

Starting in R82 Jumbo Hotfix Accumulator Take 118, the CloudGuard ControllerClosed Provisions SDDC services as Virtual Data Centers that provide virtualized computer networking, storage, and security. integrates the Check Point Security Management ServerClosed Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. with a Nozomi Networks Server.

Authentication to the Nozomi Networks Data CenterClosed Virtual centralized repository, or a group of physical networked hosts, Virtual Machines, and datastores. They are collected in a group for secured remote storage, management, and distribution of data. is done using the Nozomi Networks Hostname, Key Name, and Key Token.

Important - The CloudGuard Controller server clock must be synchronized with the current local time. Use of a NTP server is recommended. Time synchronization issues can cause polling information from the cloud to fail.

Limitations

  • The Asset IP address is not imported if it is localhost (127.0.0.1, ::1 or “localhost”).

Connecting to the Nozomi Networks Server

Use the existing credentials (Key Name and Key Token) to connect to the Nozomi Networks server.

Connecting to a Nozomi Networks Server with SmartConsole

Step

Instructions

1

In SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on., create a new Data Center object:

In the top right corner, click the Objects Pane > New > Cloud > Data Center > Nozomi

2

In Enter Name, enter the applicable name.

3

In the Hostname field, enter the Nozomi Networks server FQDN,or the server IP address and port number. Example:

nozomi_hostname

Or:

172.0.1.2<:Port>

Note - The Nozomi Networks port is optional and defaults to port 443. If your Nozomi server uses port 443, you do not need to provide the port.

4

In the Key Name and Key Token fields, enter the credentials.

5

Click Test Connection.

If the certificate window opens, confirm the certificate and click Trust.

6

When the connection status changes to Connected, click OK.

If the status is not Connected, troubleshoot the issue before you continue.

7

Click OK.

8

Publish the SmartConsole session.

9

Install the Access Control policy on the Security Gateway object.

Nozomi Networks Objects and Properties

Nozomi Networks Objects

Object

Description
Asset

Any device or system that Nozomi Networks discovers and monitors.

Tag

Resembles an attribute of an asset.

Notes:

  • An Asset can have one, multiple, or no Tags.

  • Important:

    • Import of IPv6 addresses is disabled by default. To enable it, you must set the nozomi.collectIpv6 parameter in the vsec.conf file:

      • nozomi.collectIpv6=true

      For details, refer to Configuration Parameters.

  • The import filter for asset_type is set to Any by default. To modify it, you must set the nozomi.assetType parameter in the vsec.conf file

  • The import filter for technology_category is set to OT by default. To modify it, you must set the nozomi.technologyCategory parameter in the vsec.conf file

Nozomi Networks advanced configuration

To change the default settings of Nozomi Networks Data Center in CloudGuard Controller:

  1. Add this section to the vsec.conf file on the Management ServerClosed Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server.:

    # Nozomi Data Center configuration values.
    # Overrides:
    # global.scannerInterval
    # global.scanSleepUpperLimitInSeconds
    # global.connectTimeoutInMilliseconds
    # global.readTimeoutInMilliseconds
    # Default value: 30, 300, 5000000, 120000
    # nozomi.technologyCategory - filter assets by technology category.
    # Comma-separated list of categories to import (e.g. OT,IT,IoT).
    # Set to 'Any' to import all assets regardless of technology category.
    nozomi.scannerInterval=30
    nozomi.scanSleepUpperLimitInSeconds=300
    nozomi.connectTimeoutInMilliseconds=5000000
    nozomi.readTimeoutInMilliseconds=120000
    nozomi.collectIpv6=false
    nozomi.assetType=Any
    nozomi.technologyCategory=OT

    2. For details, refer to the Configuration Parameters section.

  2. Modify the parameter values as required in your environment.

  3. Save the file and restart the CloudGuard Controller service.