1. Introduction
This document outlines the step-by-step procedures required to establish a secure and functional connection between the Albarius platform and the Check Point Security Management Server (SMS) or Multi-Domain Server (MDS).
2. Prerequisites
Before initiating the connection setup, ensure the following requirements are met:
Check Point Version: R80.x or higher (with API enabled).
Network Access: Albarius must have routeability to the Check Point Management IP address.
Credentials: Administrator account on Check Point with appropriate read/write permissions for the intended operations.
Albarius Access: Administrator access to the Albarius configuration console.
3. Network and Firewall Configuration
To allow Albarius to communicate with Check Point Management, specific ports must be permitted through any intermediate firewalls.
Navigate to the firewall policy managing traffic between the Albarius platform and the Check Point Management server.
Create a rule to permit the necessary traffic:
Source: Albarius IP Address
Destination: Check Point Management IP Address
Service/Ports:
HTTPS / TCP 443 (For Check Point Management API)
Additional policies:
Src: Clients | Dst: Albarius Server | Svc: TCP-2345
Src: CP-Mgmt | Dst: Albarius Server | Svc: 5515 UDP
Install the policy.
4. Check Point Management Configuration
4.1 Enable Management API Access
If utilizing the REST API, ensure the Management API is enabled and accessible from the Albarius environment.
Log in to Check Point SmartConsole.
Navigate to Manage & Settings > Blades > Management API.
Click Advanced Settings.
Ensure Automatic start is checked.
Set Accepted API calls from: to All IP addresses or Limit to the following IP addresses (and add the Albarius IP object).
Publish the changes.
Limit API Calls configuration
1. Command in CLI CheckPoint -> “api throttling off”
2. Restart Service - > “api restart”
Add Trusted Clients
Set IP Address of Albarius Server
Create New Trust Client Object and Set IP Address Albarius Server:
Example:
API Access Setting
Example:
4.2 Create Integration User (Optional but Recommended)
It is best practice to use a dedicated account for the Albarius integration.
Navigate to Manage & Settings > Permissions & Administrators > Administrators.
Click New to create a new administrator.
Configure the username (e.g., albarius-svc) and set a strong password.
Assign the appropriate permission profile based on the required access (e.g., Read Only All or a custom profile with specific API permissions).
Publish the changes to save the new user.
4.3 Send Logs CLI from FW to Albarius Server.
1. cp_log_export add name <Name> target-server <Target-Server> target-port 5515 protocol udp format syslog
2. cp_log_export restart name <Name>
Send Logs UI :
1. In Object Categories
2. Click Servers > Log Exporter/SIEM > Right Click New Log Exporter/SIEM
3. Set Target Port “5515 UDP”
4. Set Format “Syslog”
5. In Check Point Gateway > Logs > Export > Select Target Server
6. Install Database
Example: Steps 3,4
Example: Step 5
Check Main URL
Which port is defined 443 or Logical Port.
5. Albarius Platform Configuration
With the Check Point side prepared, configure the connection within the Albarius platform.
Log in to the Albarius portal.
Navigate to Firewalls-> Add new.
Select Check Point Management from the available integration types.
Enter the following details:
Management IP/Hostname: [Insert Check Point Management Server IP]
Username: [Insert the account created in step 4.2]
Password: [Insert credentials]
Domain (if using MDS): [Insert Domain Name or leave blank for SMS]
Click Save Configuration.
6. Verification and Testing
To ensure the connection is fully operational:
Within the Albarius integration page, click the Test Connection button.
Verify that a "Success" message is returned.
Navigate to Firewalls->Newly added firewall to confirm that data (objects, policies, or logs) is successfully synchronizing from Check Point.
7. Troubleshooting
If the connection test fails, verify the following:
API Service Status: Connect to the Check Point CLI via SSH and run api status to ensure the API service is actively listening.
Connectivity: From the Albarius appliance/server, run a ping or telnet test (telnet [Check Point IP] 443) to verify network reachability and that the port is open.
Authentication Logs: Check the api.elg log on the Check Point Management server ($FWDIR/log/api.elg) for any authentication failures or rejected API calls.