Import Certificate on Windows IIS

Finally you have chosen IIS

Import your certificate in the 'awesome' windows IIS

OK, maybe you are enforced to use IIS as web server, then, i would like to know you that my thoughts are with you.

So, let's see how to import an owned certificate in IIS environment.

Apllication and files needed:

- OpenSSL (http://www.openssl.org/)

- Certificate (.crt) file

- Private key (.key) file

Are you ready? I hope it...

1- First of all we should create a .pfx file (certificate + private key).

2- Locate your .crt and .key file.

3- Using OpenSSL:

openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile more.crt

where:

      - pkcs12 - utility for PCKS#12 files in OpenSSL

      - -export -out certificate.pfx - export and save the PFX file as certificate.pfx

      - privateKey.key - your private key

      - certificate.crt - use certificate.crt as the certificate the private key will be combined with

      - -certfile more.crt – This is optional, this is if you have any additional certificates you would like to      include in the PFX file.

4- When running the above command, you are required to generate a password for exporting file, please don't forget it.

5- You will see a new file, named 'certificate.pfx'.

6- Open IIS dashboard, then in Connections column select your server.

7- Click, on central part of window, Server Certificates icon.

8- After open it, stroke a right click and chose import from 'Actions' menu.

9- Select your newly created 'certificate.pfx' and write your export password down.

10- Click OK.

Now, you are able to see your certificate in the list, so, you can choose it in Sites/Bindings section.

Thanks to: ssl.com

Checkpoint smartcenter - manage size of $FWDIR/log/postgres.elg

In the last few months I have started migrating to R80.10 software and I found an interesting issue with the postgres sql database on smartcenter
No rotation of log file has been added to /etc/cpshell/log_rotation.conf so file , over time, can grow to any size until it fills up all disk space

Simple work around until Checkpoint fixes it

• edit /etc/cpshell/log_rotation.conf file adding this line 
• log_start list to verify that your change is visible 
• cpstop && cpstart on management 

If $FWDIR/log/postgres.elg file is way too BIG I did this fix:

after cpstop you issue cat /dev/null > $FWDIR/log/postgres.elg and file is zeroed

Checkpoint how to clear all tables of IA

The following command  clears all pdp and pep tables on security gateway:

fw tab -t pdp_sessions -t pdp_super_sessions -t pdp_super_sessions -t pdp_encryption_keys -t pdp_whitelist -t pdp_timers -t
pdp_expired_timers -t pdp_ip -t pdp_net_reg -t pdp_net_db -t pdp_cluster_stat -t pep_pdp_db -t pep_networks_to_pdp_db -t
pep_net_reg -t pep_reported_network_masks_db -t pep_port_range_db -t pep_async_id_calls -t pep_client_db -t
pep_identity_index -t pep_revoked_key_clients -t pep_src_mapping_db -t pep_log_completion -x -y

 This commands causes temporary disconnection for all traffic passing the firewall, so use it with caution

Checkpoint firewall reimaging via USB disk --- ISOMORPHIC

Just as a reminder of the options when the serial cable connection messes up the screen

R80.40 Menu

Available options:
------------------
1 - Boot from local disk
2 - 2000, 4000, 12000, 13000, 21000 series
3 - 3000, 5000, 6000, 15000, 16000, 23000, 26000 series
4 - Smart-1 5/25/50/200/400/525/625/3000/5050/5150
5 - Smart-1 150
6 - TE 250/TE1000/100X/250X/1000X/2000X
7 - 41000, 44000, 61000, 64000
8 - UTM-1, Power-1, DLP-1, VSX-1, IPS-1, Connectra, IP series
9 - Open Server with ACPI support
10 - Open Server without ACPI support
11 - Open Server with ACPI support (VGA)
12 - Open Server without ACPI support (VGA)
Default is 1, press <tab> for a list of options.

---

R81 & R81.10 Menu

Available options:
------------------
1 - Boot from local disk
2 - 2000, 4000, 12000, 13000, 21000 series
3 - 3000, 5000, 6000, 7000, 15000, 16000, 23000, 26000, 28000 series
4 - Smart-1 5/25/50/200/400/525/625/3000/5050/5150
5 - Smart-1 150
6 - TE 250/TE1000/100X/250X/1000X/2000X
7 - 41000, 44000, 61000, 64000
8 - UTM-1, Power-1, DLP-1, VSX-1, IPS-1, Connectra, IP series
9 - Open Server with ACPI support
10 - Open Server without ACPI support
11 - Open Server with ACPI support (VGA)
12 - Open Server without ACPI support (VGA)
Default is 1, press <tab> for a list of options.


---

R81.20 menu

Available options:
------------------
1 - Boot from local disk
2 - 2000, 4000, 12000, 13000, 21000 series
3 - 3000, 5000, 6000, 7000, 15000, 16000, 23000, 26000, 28000 series
4 - Smart-1 5/25/50/200/400/525/600/625/3000/5000/6000
5 - Smart-1 150
6 - TE 100X/250X/250XN/1000X/2000X/2000XN
7 - 41000, 44000, 61000, 64000
8 - UTM-1, Power-1, DLP-1, VSX-1, IPS-1, Connectra, IP series
9 - Open Server with ACPI support
10 - Open Server without ACPI support
11 - Open Server with ACPI support (VGA)
12 - Open Server without ACPI support (VGA)
Default is 1, press <tab> for a list of options.













Top CheckPoint CLI commands

This post is a summary of some of the most important Checkpoint commands taken by Checkpoint Community (CheckMates)

fw ctl zdebug drop	used to quickly see all dropped connections and more importantly the reason (e.g. anti-spoofing, IPS , FW rule , ....). USE WITH EXTREME CAUTION
cpstat fw	quickly see stats of number of connections (accepted,denied,logged) with a breakdown if the FW was under a high load i would usually run " watch --interval=1 'cpstat fw' " (would see a real-time to see the interface that is causing this)
fw tab -s -t connections	allowed me to quickly see how much load is (and was i.e "peak" ) on the FW
cphaprob stat	used to see state of cluster
fwaccel stats -s	to check acceleration status on FW
cphaprob -a if	used to do troubleshooting cluster, verify all interfaces are UP and the Virtual IP address for the cluster interfaces

Policy installation failed after cluster configuration

A few day ago, I've created a new cluster on a mgmt that already manage other clusters.

On this new cluster the only interface configured was the MGMT, the other interfaces were all in shut and not configured, so in topology I defined the MGMT interface as cluster interface.

After creation of the cluster I tried to install policy and the policy installation failed.

This is a classic issue, the cluster always needs a sync interface so in topology I changed the interface and defined it as Sync, although it's not sync if.

After this change everything was ok and I was able to install policy.

Easy ways to get your IP address on a Linux box

Here are some easy ways to obtain your IP address on a Linux box

• dig +short myip.opendns.com @resolver1.opendns.com
• curl -s http://whatismyip.akamai.com/

• curl -s icanhazip.com