Help! How to set up authenticated LEA connection to CP-R55

I have some questions, dear all, help me, please.

I try to set up authenticated LEA connection to NAG-R55.
I already read docs, but I can't understand how to set up.
I create LEA server (name:FWA itself IP, port:18184),is it right?
second, I config fwopsec.conf to open port 18184 and restart CP service.

And I create a new Opsec Application Object, include to do SIC.

Should I do the step "changes to LEA server on FWA", that docs says?
I can't understand this step, and how to do.
How can I get opsec_pull_cert tool?
Grand masters and supports teach me details, please.
Teach me how to set up correctly.
Thanks
Best Regards,
Caspar Wang