USM Appliance™

Check Point Firewall

When you configure Check Point Firewall-1 to send log data to USM Appliance, you can use the Check Point Firewall plugin to translate raw log data into normalized events for analysis. The table below provides some basic information for the plugin:

Plugin Information
Device Details
Vendor Check Point
Device Type Firewall
Connection Type Syslog
Data Source Name fw1-alt
Data Source ID 1590

Integrating Check Point Firewall-1

Before you configure the Check Point Firewall-1 integration, you must have the IP Address of the USM Appliance Sensor and the firewall must have the Add-On Package R77.30 installed.

Note: This procedure does not support the Provider-1 / Multi-Domain Server.

To configure Check Point Firewall-1 to send data to USM Appliance

  1. On the Check Point appliance, back up the current /etc/syslog.conf script:

    cp /etc/syslog.conf /etc/syslog.conf_ORIGINAL

  2. Edit the current /etc/syslog.conf script by adding the following line: @<IP address of the USM Appliance Sensor>

    Note: Press TAB after

  3. Save your configuration edits and close the file.

  4. Back up the /etc/rc.d/init.d/cpboot script, and edit the current version of /etc/rc.d/init.d/cpboot by adding the following line at the bottom of the script:

    fw log -f -t -n -l 2> /dev/null | awk 'NF' | logger –p -t CP_FireWall &


    & = run command in the background. If & is not included, the operating system stops before loading the syslogd service. No login prompt then appears at the console.

    For help on available flags, enter:

    fw log --help

  5. Save the configuration edits and close the file.
  6. Restart the machine.

    Important: Restarting the Check Point services with the cpstop;cpstart commands does not suffice. Only a restart achieves the desired result.

Plugin Enablement

For plugin enablement information, see Enable Plugins.


For troubleshooting, refer to the vendor documentation: