Sometimes the cplic print command on a gateway does not display contract information.
This may prevent download of updates from Checkpoint cloud.
You can use the contract_util command to download the contract info from the Smartcenter
Expert# contract_util mgmt
fetching contracts data from managment
download from management result: Contract verification succeeded. Your gateway is eligible for upgrade according to Check Point licensing agreement.
Thursday, September 24, 2015
Friday, August 7, 2015
Secret NSA map
https://lnkd.in/eFndcyc | A secret NSA map shows successful Chinese attacks
lnkd.in/eFndcyc
#securityaffairs #NSA #hacking #China
Thursday, July 30, 2015
Friday, May 29, 2015
Checkpoint firewall - How to list all kernel parameters
Kernel parameters in Checkpoint firewall can be queried with the command
fw ctl get <kernel_param>
Most of the time you find the kernel parameter you need by reading some Checkpoint SK or any article on the Internet
I found an interesting article provided by Checkpoint to dump all kernel parameters on a firewall by probing the fwmod kernel module.
By logging to a Checkpoint firewall in Expert mode it is possible to use the standard Linux command modinfo to get the information from the Checkpoint Kernel module
fw ctl get <kernel_param>
Most of the time you find the kernel parameter you need by reading some Checkpoint SK or any article on the Internet
I found an interesting article provided by Checkpoint to dump all kernel parameters on a firewall by probing the fwmod kernel module.
By logging to a Checkpoint firewall in Expert mode it is possible to use the standard Linux command modinfo to get the information from the Checkpoint Kernel module
Wednesday, February 11, 2015
Checkpoint cpsizeme utility
Description
The '
This '
It is possible to upload the raw data to Check Point and e-mail the report at any time, even after running the script
Running the utility
You can choose the period of time to run the utility
here is the syntax for collecting data for two hours
cpsizeme 2h
Over the next 2 hours, the utility will collect performance data
from your appliance. It is recommended to run the utility on the
part of the week where you expect peak performance.
______________________________
After running this utility, 2 archive files are created:
1. Detailed archive file - includes all the collected raw performance data used
for analysis & statistics, including information such as connections and
routing tables with IP addresses. Used mainly by Check Point support staff.
2. Summary archive file - needed for generating a PDF document of the gateway
performance statistics of traffic, cpu, memory utilization and an XML file to
be used for appliance sizing. This archive does not include connection data
and IP addresses.
Note: Sharing your performance information with Check Point will help us to
improve our products.
Please choose:
1 Run the utility and automatically send both the detailed & summary
archives to Check Point
2 Run the utility and automatically send only the summary archive to
Check Point
3 Run the utility without sending the data automatically to Check Point
Your choice? [1]
press Enter to continue
Testing connection to Check Point...ok!
______________________________
* What is your email address? (this is required for receiving PDF via email,
email length should be shorter than 80 characters)? XXXX@domain
Any generated PDF report will be sent to 'XXXX@domain', is the email address correct (choosing 'n' will allow changing the email address) (y/n)? [y]
______________________________
Sharing some details about your organization will help us to
better analyze your report.
* Would you like to answer a few questions (y/n)? [y] n
Thank you for your input.
Loading service...
The background service was started at 2015-02-11 11:48:51 (Wednesday)
Data collection will finish at 2015-02-11 13:48:51 (Wednesday)
Data analysis may take an additional 1 hour.
Once done, data analysis will be available by:
/opt/CPsuite-R77/fw1/bin/cpsizeme -S
The report will be uploaded automatically to Check Point.
Uploading the data to CP
Once the utility has collected the data you can upload it to Checkpoint
/opt/CPsuite-R77/fw1/bin/cpsizeme -S
Please choose an option:
1 Show upload history
2 Show summary of last successful session
3 Show summary of gathered information
4 Show instructions to get sizing PDF report via email
5 Show location of generated files
6 Send summary & detailed archives to Check Point
7 Send summary archive to Check Point
8 Reanswer the utility's questions
9 Cleanup login notifications & optionally all related files
10 Exit
Your choice? 6
Send summary & detailed archives to Check Point
Uploading: ...
Uploading summary & detailed archives at 2015-02-11 14:02:19 (Wednesday) succeeded
Press enter key to continue...
The '
cpsizeme' is a lightweight shell script that
produces a detailed performance report of Check Point Security Gateway.
This script measures the ongoing resource utilization on Security
Gateway during the given time period This '
cpsizeme' output and report can assist in improving the sizing accuracy in any one of the following scenarios:- Replacing the current Security Gateway appliance/server with a new one.
- Future growth and planning ahead.
- Enabling more security Software Blades on the current Security Gateway.
- Troubleshoot performance issues on the Security Gateway
It is possible to upload the raw data to Check Point and e-mail the report at any time, even after running the script
Running the utility
You can choose the period of time to run the utility
here is the syntax for collecting data for two hours
cpsizeme 2h
Over the next 2 hours, the utility will collect performance data
from your appliance. It is recommended to run the utility on the
part of the week where you expect peak performance.
______________________________
After running this utility, 2 archive files are created:
1. Detailed archive file - includes all the collected raw performance data used
for analysis & statistics, including information such as connections and
routing tables with IP addresses. Used mainly by Check Point support staff.
2. Summary archive file - needed for generating a PDF document of the gateway
performance statistics of traffic, cpu, memory utilization and an XML file to
be used for appliance sizing. This archive does not include connection data
and IP addresses.
Note: Sharing your performance information with Check Point will help us to
improve our products.
Please choose:
1 Run the utility and automatically send both the detailed & summary
archives to Check Point
2 Run the utility and automatically send only the summary archive to
Check Point
3 Run the utility without sending the data automatically to Check Point
Your choice? [1]
press Enter to continue
Testing connection to Check Point...ok!
______________________________
* What is your email address? (this is required for receiving PDF via email,
email length should be shorter than 80 characters)? XXXX@domain
Any generated PDF report will be sent to 'XXXX@domain', is the email address correct (choosing 'n' will allow changing the email address) (y/n)? [y]
______________________________
Sharing some details about your organization will help us to
better analyze your report.
* Would you like to answer a few questions (y/n)? [y] n
Thank you for your input.
Loading service...
The background service was started at 2015-02-11 11:48:51 (Wednesday)
Data collection will finish at 2015-02-11 13:48:51 (Wednesday)
Data analysis may take an additional 1 hour.
Once done, data analysis will be available by:
/opt/CPsuite-R77/fw1/bin/cpsizeme -S
The report will be uploaded automatically to Check Point.
Uploading the data to CP
Once the utility has collected the data you can upload it to Checkpoint
/opt/CPsuite-R77/fw1/bin/cpsizeme -S
Please choose an option:
1 Show upload history
2 Show summary of last successful session
3 Show summary of gathered information
4 Show instructions to get sizing PDF report via email
5 Show location of generated files
6 Send summary & detailed archives to Check Point
7 Send summary archive to Check Point
8 Reanswer the utility's questions
9 Cleanup login notifications & optionally all related files
10 Exit
Your choice? 6
Send summary & detailed archives to Check Point
Uploading: ...
Uploading summary & detailed archives at 2015-02-11 14:02:19 (Wednesday) succeeded
Press enter key to continue...
Wednesday, December 17, 2014
Checkpoint -- queryDB_util to query Smartcenter from command line
A few days ago I looked at the licenseDataCollector.sh: script and found that it was creating a lot of files in a temporary directory. these files were the network objects in the Smartcenter DB.
inside the script I found several calls to the command queryDB_util
some investigation on Google returned a few hits on this interesting tool
here is the help from the queryDB_util
U s a g e:
==========
queryDB interactive mode:
----------------------
[-t <table_name> [-s <query_str>]] # name of requested table. 'query_str' is valid CPMI query string
[-o <object_name>] # name of requested object
[-a] # prints details of all objects
[-mu <modified_by>] # administrator who last modified the object
[-mh <modified_from>] # host from which object was last modified
[-ma <modified_after>] # minimum last modification date <[hh:mm:ss][-ddmmmyyyy]>
[-mb <modified_before>] # maximum last modification date <[hh:mm:ss][-ddmmmyyyy]>
[-p<m|u|h|t|f>] # special print options:
# m - last_modification details
# u - administrator name modification
# h - host name modification
# t - last modification time
# f - fields details
[-f <file_name>] # output file name for results
[-h] # get this usage info
[-q] # quit
Arguments can appear in any order.
If an argument appears more than once, the last one counts.
To get one of 'Objects Query' or 'Rules Query' modes:
----------------------------------------------------
Phase I - connection arguments:
----------------------------------
-s <server_name> [-u <username> -p <password> | -c <certificate_name> -p <password>]
Phase II - feature-mode argument:
------------------------------------
-objectsquery | -rulesquery #'objectsquery' for Objects Query, 'rulesquery' for Rules Query
Phase III - specific mode arguments:
---------------------------------------
Objects Query Usage:
====================
<ip address(es)> #one or more ip addresses to be query for their referencing objects
Rules Query Usage:
==================
-ob <network_objects name(s) or ip(s)> #a mix of objects names and ip addresses is valid
[-c <column_name>] #specify the query on one column
[-op] #search of ALL given objects under sub-query (default: AT LEAST ONE)
[-e] #force explicit search in rules (default: implicit search)
[-n] #for search of the negation of sub-query
[-r] #defines an OR relation on all sub-queries. (default: AND relation)
Notes:
======
1. Only the -ob argument has to be present. This argument informs the utility that a new sub-query is to be parsed.
2. Due to the former note, the -ob argument have to be the first argument of each sub-query input.
3. The -r argument applies to all of the sub-queries set and defines there relation. Since the number of sub-queries is unlimited, this argument must come last!
4. All other arguments can appear in any order.
Enter Server name:
Query to find all firewalls modules (both managed and externally managed:
echo -e "localhost\n-t network_objects -s type='gateway' -s cp_products_installed='true' \n-q" | queryDB_util | grep Object
Object Name: FW1
Object Name: FW2
Object Name: Fw3
Object Name: FW4
Object Name: Fw5
If you want to go deeper you change the greps
echo -e "localhost\n-t network_objects -s type='gateway' -s cp_products_installed='true' -pf \n-q" | queryDB_util | egrep 'Object Name|location:|osName' | grep -v ip_pool | grep -v phone_directo
Object Name: FW1
location:internal
osName=Gaia
Object Name: FW2
location:external
Object Name: Fw3
inside the script I found several calls to the command queryDB_util
some investigation on Google returned a few hits on this interesting tool
here is the help from the queryDB_util
U s a g e:
==========
queryDB interactive mode:
----------------------
[-t <table_name> [-s <query_str>]] # name of requested table. 'query_str' is valid CPMI query string
[-o <object_name>] # name of requested object
[-a] # prints details of all objects
[-mu <modified_by>] # administrator who last modified the object
[-mh <modified_from>] # host from which object was last modified
[-ma <modified_after>] # minimum last modification date <[hh:mm:ss][-ddmmmyyyy]>
[-mb <modified_before>] # maximum last modification date <[hh:mm:ss][-ddmmmyyyy]>
[-p<m|u|h|t|f>] # special print options:
# m - last_modification details
# u - administrator name modification
# h - host name modification
# t - last modification time
# f - fields details
[-f <file_name>] # output file name for results
[-h] # get this usage info
[-q] # quit
Arguments can appear in any order.
If an argument appears more than once, the last one counts.
To get one of 'Objects Query' or 'Rules Query' modes:
----------------------------------------------------
Phase I - connection arguments:
----------------------------------
-s <server_name> [-u <username> -p <password> | -c <certificate_name> -p <password>]
Phase II - feature-mode argument:
------------------------------------
-objectsquery | -rulesquery #'objectsquery' for Objects Query, 'rulesquery' for Rules Query
Phase III - specific mode arguments:
---------------------------------------
Objects Query Usage:
====================
<ip address(es)> #one or more ip addresses to be query for their referencing objects
Rules Query Usage:
==================
-ob <network_objects name(s) or ip(s)> #a mix of objects names and ip addresses is valid
[-c <column_name>] #specify the query on one column
[-op] #search of ALL given objects under sub-query (default: AT LEAST ONE)
[-e] #force explicit search in rules (default: implicit search)
[-n] #for search of the negation of sub-query
[-r] #defines an OR relation on all sub-queries. (default: AND relation)
Notes:
======
1. Only the -ob argument has to be present. This argument informs the utility that a new sub-query is to be parsed.
2. Due to the former note, the -ob argument have to be the first argument of each sub-query input.
3. The -r argument applies to all of the sub-queries set and defines there relation. Since the number of sub-queries is unlimited, this argument must come last!
4. All other arguments can appear in any order.
What can you do with this utility?
You can query the Smartcenter database for all kind of objects ( as long as you understand the CPMI syntax).
here are a few examples to give you an idea taken from the licenseDataCollector.sh script
return number of smartcenter objects:
echo -e "localhost\n-t network_objects -s management='true'\n-q" | queryDB_util
Enter Server name:
Please enter a query, -h for help or -q to quit:
query>
Q u e r y i n g D B
=====================
Object Name: Management1
Table Name: network_objects
Last Modified by: Security Management Server
Last Modified from: localhost
Last Modification time: Tue Sep 9 09:26:09 2014
Object Name: Management2
Table Name: network_objects
Last Modified by: Security Management Server
Last Modified from: localhost
Last Modification time: Tue Sep 9 09:26:08 2014
Object Name: Management3
Table Name: network_objects
Last Modified by: Security Management Server
Last Modified from: localhost
Last Modification time: Tue Sep 9 09:26:06 2014
A total of 3 objects match the query.
query all network objects of type host, then extract with grep name and ip address
echo -e "localhost\n-t network_objects -s type='host' -pf\n-q" | queryDB_util | egrep 'Name Object|ipaddr:'
Object Name: Node1
ipaddr: 10.1.2.3
Object Name: Node2
ipaddr: 10.4.5.6
Query to find all firewalls modules (both managed and externally managed:
echo -e "localhost\n-t network_objects -s type='gateway' -s cp_products_installed='true' \n-q" | queryDB_util | grep Object
Object Name: FW1
Object Name: FW2
Object Name: Fw3
Object Name: FW4
Object Name: Fw5
If you want to go deeper you change the greps
echo -e "localhost\n-t network_objects -s type='gateway' -s cp_products_installed='true' -pf \n-q" | queryDB_util | egrep 'Object Name|location:|osName' | grep -v ip_pool | grep -v phone_directo
Object Name: FW1
location:internal
osName=Gaia
Object Name: FW2
location:external
Object Name: Fw3
location:internal
osName=Gaia
Furthering analyzing the text based objects_5.0.C file provides info about the query that should be performed to obtain specific objects. ClassName attribute provides the type that should be queried.
For example here is a list of possible types:
osName=Gaia
Furthering analyzing the text based objects_5.0.C file provides info about the query that should be performed to obtain specific objects. ClassName attribute provides the type that should be queried.
For example here is a list of possible types:
- gateway
- host
- cluster_member
- gateway_cluster
- network
- group_with_exception
Tuesday, December 2, 2014
Checkpoint - how to install updates with CPUSE from Gaia CLISH
- First update CPUSE software
- Download latest build from Usercenter
- Latest build of Check Point CPUSE - Gaia Software Updates(Solution ID: sk98228). At 02 Dic. 2014 build 714 is latest version.
- To check the current version of the Gaia Software Updates Agent, run[Expert@HostName]# cpvinfo $DADIR/bin/DAService | grep -E "Build|Minor"
- Transfer the updated Gaia Software Updates Agent package (GaiaSoftwareUpdatesAgent_<build>.tgz) to the machine into /tmp/DA.patch directory.
- Unpack the Gaia Software Updates Agent package:
- [Expert@HostName]# cd /tmp/DA.patch
- [Expert@HostName]# tar zxvf GaiaSoftwareUpdatesAgent_<build>.tgz
Install the Gaia Software Updates Agent RPM (starting in Build 553, the currently running agent will be automatically stopped during the RPM installation):
- $DADIR/stop/dastop
- dbget installer:stop
- [Expert@HostName]# rpm -Uhv --force CPda-00-00.i386.rpm
- Start the Gaia Software Updates Agent:
- [Expert@HostName]# $DADIR/bin/dastart
Installation instructions for Hotfixes / Minor version / Major version
- Log in to Clish shell.
- See the list of available packages for download:
- HostName> show installer available_packages
Num File Name Type
1 Check_Point_Hotfix_R77_sk101186.tgz Hotfix
2 Check_Point_Hotfix_R77_sk100431.tgz Hotfix
3 Check_Point_R76_T265.tgz Major Version
4 Check_Point_Hotfix_R77_sk100195.tgz Hotfix
5 Check_Point_Hotfix_R77_sk98814.tgz Hotfix
6 Check_Point_R77_Hotfix_SK97566.tgz Hotfix
7 Check_Point_R75.46_Fresh_Install.tgz Major Version
8 Check_Point_hotfix_R77_sk96269.tgz Hotfix
9 Check_Point_R77_UDP_Hotfix_sk95056.tgz Wrapper
10 Check_Point_SmartConsole_and_SmartDomain_Manager_R... Wrapper
11 Check_Point_R77.tgz Major Version
12 Check_Point_R75_40VS_T157.tgz Major Version
13 Check_Point_Hotfix_R77_sk102673.tgz Hotfix
14 Check_Point_Hotfix_R77_sk102989.tgz Wrapper
15 Check_Point_R77.10.tgz Wrapper
16 Check_Point_R77_R77_20_T124.tgz Wrapper
- Hostname> installer download 16
- verify download progress
- Hostname> show installer package_status
Check_Point_R77_R77_20_T124.tgz - Downloading (1.05 MB/s) - Progress: 92%
- Hostname> installer install 16
- verify installation progress
- Hostname> show installer package_status
16 Check_Point_R77_R77_20_T124.tgz Installing (0%)
after installing the upgrade package R77.20 the firewall will automatically reboot
Subscribe to:
Posts (Atom)