This article applies to:

• Firewall Suite 3.1+

Question:

Information:

The OPSEC LEA connection used to retrieve log data from Check Point firewalls may, at times, be difficult to establish. Often, this is a result of a missed step in the Firewall Suite Configuration Guide, or misconfiguration of the firewall rule or the fwopsec.conf file. There are, however, other possible causes.

To access the Firewall Suite Configuration Guide please click the link below:

https://support.trustwave.com/Firewall-Suite/Documentation.asp

The following steps will help to determine what issues are occurring with the LEA service:

1. Edit the webtrends.ini file and under [Defaults] add the following line:

   LeaDebugOn=1

2. Download DebugView from the following site:

   http://www.sysinternals.com/ (this is a freeware application)

3. Delete any Firewall Suite profiles that use the OPSEC LEA connection.

4. Exit and Unload Firewall Suite (close the application, not uninstall).

5. Restart the machine where Firewall Suite is installed.

6. Start DebugView and allow it to run in the background.

7. Start Firewall Suite and create a new profile using OPSEC LEA.

8. Check the Services window to ensure that the OPSEC LEA service has started. If not, manually try to start the service.

9. If the OPSEC LEA service fails to start, note the data collected by DebugView for analysis.

The following table will provide some possible causes:

* CP - Check Point

Notes:

This article was previously published as:

NETIQKB1542