Opsec LEA SSLCA connection is not being established with Check Point NG device.

This article applies to:

• Security Reporting Center 2.X
• Firewall Suite 4.1c
• Check Point NG
• SSLCA Connection Type

Symptoms:

• Opsec LEA SSLCA connection is not being established with Check Point NG device.
• Error: "LeaEndSessionHandler: Log Sic Failure Reason : 119 - SIC Error for lea: Client could not choose an authentication method for service lea."
• Error: "LeaEndSessionHandler: opsec_session_end_reason returned: SIC_FAILURE"

Causes:

Resolution:

To resolve this issue please follow the steps below:

1. On the Check Point NG device, open the fwopsec.conf file.

2. Find all lines that start with lea_server and comment them out by putting a '#' sign in front of the line.

3. Save the file.

4. Create a rule that accepts traffic from the WebTrends Firewall Suite or Security Reporting Center machine.

5. Save the settings.

6. Re-install the policy.

Note: The fwopsec.conf file will only be present if the firewall has been upgraded from a prior release of NG.  If it is a fresh installation of NG, start with Step 4.

After these steps, stop and restart the LEA service. The steps for doing so are different in each product. Please see the appropriate set of steps:

• Firewall Suite:

  1. Click Start | Settings | Control Panel | Administrative Tools | Services.

  2. Locate WebTrends LEA Server in the list of services.

  3. Right click and choose Restart.

• Security Reporting Center:

  1. Click Start | Settings | Control Panel | Administrative Tools | Services.

  2. Locate NetiQ - LEA Service in the list of services.

  3. Right click and choose Restart.

After the service has been restarted you should then be able to check the location where the log files are being stored, and see that the data is coming across.

This article was previously published as:

NETIQKB33601