Thursday, October 29, 2015

CBL checking

http://www.anti-abuse.org/multi-rbl-check/

http://rbls.org/

http://mxtoolbox.com/blacklists.aspx

http://www.kloth.net/services/

 ------------------

The world's largest Email and Web traffic monitoring network

https://www.senderbase.org

Sunday, October 11, 2015

RBL checking

here is a list of website where you can check if you IP address is blacklisted

http://www.anti-abuse.org/multi-rbl-check/

http://rbls.org/

http://mxtoolbox.com/blacklists.aspx

http://www.kloth.net/services/

Friday, October 9, 2015

Checkpoint - VPN debugging

here is a brief procedure with the steps to run to debug issues on IPSEC VPN on a Checkpoint firewall


  • Reset IKE and ISAKMP keys using the vpn tu command 
  • Enable debugging for IKE and VPND


[Expert@HostName]# vpn debug trunc
[Expert@HostName]# vpn debug on TDERROR_ALL_ALL=5



  • Run fw monitor to capture packets on th firewall


[Expert@HostName]# fw monitor -e "accept;" -o /var/log/capture.cap


  • In another shell start kernel debugging with following parameters 


[Expert@HostName]# fw ctl debug 0
[Expert@HostName]# fw ctl debug -buf 32000
[Expert@HostName]# fw ctl debug -m fw + conn drop vm crypt
[Expert@HostName]# fw ctl debug -m VPN all
[Expert@HostName]# fw ctl kdebug -T -f > /var/log/kerneldebug.txt


  • Generate traffic across the tunnel and try to replicate the issue



  • Stop debugging 


Press CTRL-C and run
[Expert@HostName]# fw ctl debug 0

Stop debugging and fw monito

[Expert@HostName]# vpn debug off
[Expert@HostName]# vpn debug ikeoff

Ctrl-C on shell where fw monitor is running

Debug information is contained in the following files:

  • /var/log/capture.cap from the Security Gateway
  • /var/log/kerneldebug.txt from the Security Gateway
  • $FWDIR/log/ike.elg* from the Security Gateway
  • $FWDIR/log/ikev2.xml* from the Security Gateway
  • $FWDIR/log/vpnd.elg* from the Security Gateway