Check Point Firewalls

• Design
• Network Ports used for communication
• Log Files location Check Point
• Operation
• Useful CLI Commands Check Point
• Export/Import Policy Package
• Useful Smartlog Queries
• Useful SNMP OIDs (VSX)
• Threat Prevention API
• GAIA - Easy execute CLI commands on all gateways simultaneously
• Threat Prevention Cyber Attacks Dashboard Template
• DOS & DDOS Prevention, Mitigation
• Export Syslog Messages
• Missing feature - Global search across multiple CMA
• Show logging using the web interface
• Managing partition sizes via LVM manager on Gaia OS
• SmartConsole cli parameters
• Jump to Rule Number or UID
• SmartConsole: Clear disconnected sessions
• Initiating manual cluster failover
• How to migrate Custom Queries from one SmartView Tracker to another
• Check Point Log Export
• Troubleshooting
• After policy install: UDP packet that belongs to an old session drops
• How to copy a file from a Check Point firewall
• CPView Utility and High Load Traffic
• IPS Troubleshooting
• Limitation of 251 Inline Layers
• Packetpushers with SQLNet
• Show interface speed and duplex as a list
• VPN Troubleshooting
• Threat Extraction Troubleshooting
• Links & Tools
• Check Point Links & Tools

Design

Network Ports used for communication

Introduction

This drawing should give you an overview of the used R80 and R77 ports respectively communication flows. It should give you an overview of how different Check Point modules communicate with each other. Furthermore, services that are used for firewall operation are also considered. These firewall services are also partially mapped as implied rules in the set on the firewall.

Link

Thank you Heiko Ankenbrand for creating such a valuable overview:

https://www.ankenbrand24.de/index.php/articles/check-point-articel/arcitecture/r80-communication-ports/

Overview

Download

https://www.ankenbrand24.de/wp-content/uploads/2019/12/Ports_1.5a.pdf

Log Files location Check Point

Here are the different Log File locations on a Check Point Appliance:

Operation

Useful CLI Commands Check Point

Cheatsheets

• Check Point CLI Reference Card (https://www.roesen.org/files/cp_cli_ref_card.pdf)
• FW Monitor (https://www.roesen.org/files/fw_monitor.pdf)
• R80 Cheat Sheet FW-Monitor (https://www.ankenbrand24.de/index.php/articles/check-point-articel/cheat-sheets/r80-cheat-sheet-fw-monitor/)
• ClusterXL Cheat Sheet (https://www.ankenbrand24.de/index.php/articles/check-point-articel/cheat-sheets/r80-cheat-sheet-clusterxl/)

CLISH Commands

To start a transaction in CLISH use start transaction.

Commands - commit, or rollback to be used to end the transaction mode. All changes made using commands in transaction mode are applied at once or none of the changes are applied based on the way transaction mode is terminated.

Show Commands

Set Commands

Generic Commands

The commands below have to be used in expert mode and NOT in clish.

Example Reset admin password without access to GW:

/sbin/grub-md5-crypt

cprid_util -server <IP_of_Gateway> -verbose rexec -rcmd /bin/clish -s -c \
'set config-lock on override'  # Ensure clish db is unlocked

cprid_util -server <IP_of_Gateway> -verbose rexec -rcmd /bin/clish -s -c \
'set user admin password-hash <Password_Hash_from_Step_above>' # Set admin user pw hash

cprid_util -server <IP_of_Gateway> -verbose rexec -rcmd /bin/clish -s -c \
'set expert-password-hash <Password_Hash_from_Step_above>' # change expert pw hash

VPN Commands

The commands below have to be used in expert mode and NOT in clish.

To view informations about VPN Tunnels

In R80+: 

• Open SmartConsole > Logs & Monitor.
• Open the catalog (new tab).
• Click Tunnel & User Monitoring.

See also: Logging and Monitoring R80.10 (Part of Check Point Infinity) 

VSX specific

The commands below have to be used in expert mode and NOT in clish

Example:

# vsx stat -v -l

VSID:            0
VRID:            0
Type:            VSX Gateway
Name:            fwvsx01
Security Policy: fwvsx01_VSX
Installed at:    21Nov2019 10:30:11
SIC Status:      Trust
Connections number: 66
Connections peak:   765
Connections limit:  14900

VSID:            1
VRID:            1
Type:            Virtual System
Name:            fw01p
Security Policy: FW_01
Installed at:    25Nov2019 11:30:39
SIC Status:      Trust
Connections number: 30628
Connections peak:   90464
Connections limit:  119900

API specific (mgmt_cli)

API Manual: https://sc1.checkpoint.com/documents/R80/APIs/index.html

The mgmt_cli tool is installed as part of Gaia on all R80 gateways and can be used in scripts running in expert mode.
The mgmt_cli.exe tool is installed as part of the R80 SmartConsole installation (typically under C:\Program Files (x86)\CheckPoint\SmartConsole\R80\PROGRAM\) and can be copied to run on any Windows machine. 

On Windows you cannot login with a certificate since the mgmt_cli_login is missing, you need to login with user/password or use the mgmt_cli tool on the management server.

To use the actual ssh login with mgmt_cli use the undocumented feature
mgmt_cli -r true

If your mgmt server is running on another port (ex. 8443) use
mgmt_cli --port 8443

Show api-settings

Check if clients are allowed to connect to the api and check all the api-settings.

mgmt_cli -r true --domain 'System Data' show api-settings


...
accepted-api-calls-from: "all ip addresses"
...

API Status

To confirm that the API is usable and available remotely, run the api status command. If Accessibility shows “Require all granted” it means that any system can access the API (on R80 this will show “Allow all”).

[Expert@awsmgmt:0]# api status

API Settings:
---------------------
Accessibility:                      Require all granted
Automatic Start:                    Enabled

Processes:

Name      State     PID       More Information
-------------------------------------------------
API       Started   14472
CPM       Started   14350     Check Point Security Management Server is running and ready
FWM       Started   13807

Port Details:
-------------------
JETTY Internal Port:      50276
APACHE Gaia Port:         443


--------------------------------------------
Overall API Status: Started
--------------------------------------------

API readiness test SUCCESSFUL. The server is up and ready to receive connections

Notes:
------------
To collect troubleshooting data, please run 'api status -s <comment>'

API Status Troubleshooting data

To create a <comment>.tgz file with troubleshooting data start

api status -s <comment>

logging in

First create a session into a file and reuse it:

mgmt_cli login user admin > id.txt

With read-only access:

mgmt_cli login user admin read-only true > id.txt

Search object in database

search objects by IP, return all objects that contain the ip explicitly or within a nework address space/range.

mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true --format json | jq '.objects[] | {name: .name, subnet: .subnet4, mask: ."mask-length4"}'

Show Hosts

mgmt_cli -s id.txt show hosts --format json

Show access layers

mgmt_cli show access-layers limit 500 -s id.txt --format json | jq '."access-layers"[].name'

Output:
"Layer1"
"Layer2"
...

Show number of rules in policy

mgmt_cli show access-rulebase name "<layer>" -s id.txt --format json limit 1 | jq '.total'

Show access rule base

mgmt_cli show access-rulebase offset 0 limit 20 name "Network" details-level "standard" use-object-dictionary true show-hits true hits-settings.from-date "2020-01-01" hits-settings.to-date "2020-12-31T23:59" hits-settings.target "corporate-gw" --format json

Display rule with explicit uid

mgmt_cli -s id.txt show access-rule layer "My_policy Network" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"

Show unused objects in objects-db

mgmt_cli show unused-objects offset 0 limit 50 details-level "standard" -s id.txt --format json

Show changes from who and when in objects-db

mgmt_cli show changes from-date "2019-04-11T08:20:50" to-date "2019-04-15" -s id.txt --format json

Run script on firewall

https://sc1.checkpoint.com/documents/latest/APIs/index.html#web/run-script~v1.6%20

mgmt_cli run-script script-name "ifconfig" script "ifconfig" targets.1 "corporate-gateway" -s id.txt --format json

Show application-site URLs

mgmt_cli show application-site name "HTTPS Pass Through Global" details-level "standard" -s id.txt --version 1.2 --format json

Show VPN communities

mgmt_cli -r true show vpn-communities-star details-level full -s id.txt --format json

mgmt_cli -r true show vpn-communities-meshed details-level full -s id.txt --format json

Count and show access-layers (Inline Layers)

mgmt_cli show access-layers limit 500 --format json

Output:

.
.
 } ],
 "from" : 1,
 "to" : 260,
 "total" : 260
}

Links

http://sicuriconnoi.blogspot.com/2017/11/top-checkpoint-cli-commands.html

Check Point stattest Utility for OID Troubleshooting on GW
https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_CLI_ReferenceGuide/Content/Topics-CLIG/FWG/stattest.htm

Export/Import Policy Package

Check Point ExportImportPolicyPackage tool enables you to export a policy package from a Management database to a .tar.gz file, which can then be imported into any other Management database. The tool is supported for version R80.10 and above.

This tool can be used for backups, database transfers, testing, and more.

Link: https://github.com/CheckPointSW/ExportImportPolicyPackage

Useful Smartlog Queries

Generic Queries

Threat Extraction / Emulation

Endpoint Security & Remote Access

Useful SNMP OIDs (VSX)

Check Point and SNMP

Monitoring for a Firewall is important, you need to make sure that you see the baseline of your environment and that you can see when some value will go up too high.

The following guide is showing some of the most used SNMP OID for monitoring generic HW Appliances and VSX Clusters.

To Browse the Check Point MIBS use: https://mibs.observium.org/mib/CHECKPOINT-MIB/ or http://oidref.com/1.3.6.1.4.1.2620

Activate SNMP

To enable SNMP on a Check Point FW checkout the sk90860

Check Point MIB Files

MIB Files can be found in sk90470

SNMP OIDs

OIDs: Hardware Status

Hardware sensors (fans, power supplies, temperatures and raid state)

OIDs: Connections

Current connections in certain virtual system and the configured limit.
This limit is configured in the virtual system properties, Optimization section (Capacity Optimization)

OIDs: ClusterXL state

If you manage a Checkpoint ClusterXL, I suppose you use quite a lot the “cphaprob state” command.

OIDs: CPU

Monitor each of the CPUs

OIDs: Memory

Counters

Traps

OIDs: Memory VSX

The following SNMP queries have to be done on the VSX Host.

Links

Thank you for this BLOG entry somoit.net:

https://somoit.net/checkpoint-fw/useful-snmp-oids-monitor-vsx

Threat Prevention API

Threat Prevention APIs

Take control of the Threat Prevention APIs powered by the largest Threat Cloud in the industry

URL Reputation – for a domain/URL returns the classification and risk in accessing the resource
File Reputation – for a file digest (md5/sha1/sha256/sha512) returns the risk in downloading the file without the need to scan it
IP Reputation  - for an IP address returns it’s classification and risk in accessing a resource hosted on it
Mail Security – upload an email for scanning against malware and phishing attacks, based on award winning Sandblast engines

All APIs are RESTful, simple to use and can be integrated as part of a SOAR application, home-made application and more!

Detailed API instructions including samples in Java/Python can now be found in the GitHub repository.

Check it out here - https://github.com/CheckPointSW/reputation-service-api

Swagger UI to explore the API

https://app.swaggerhub.com/apis-docs/cp-devops-cloud/reputation-service

GAIA - Easy execute CLI commands on all gateways simultaneously

Link

https://community.checkpoint.com/t5/Enterprise-Appliances-and-Gaia/GAIA-Easy-execute-CLI-commands-on-all-gateways-simultaneously/m-p/50883

Threat Prevention Cyber Attacks Dashboard Template

If you have Anti-Bot, Anti-Virus, IPS, Threat Emulation Blades active and a SmartLog License, you're maybe interested to see the following Dashboard:

Description and Download of the Template here: https://community.checkpoint.com/community/management/visibility-monitoring/blog/2018/04/04/threat-prevention-cyber-attacks-dashboard

DOS & DDOS Prevention, Mitigation

Preface

Since R80.20 DOS/DDOS Prevention changed in Check Point.
The following is a summary how you can setup and mitigate DOS & DDOS attacks.

SYN Defender since R80.20

Important changes in IPS "SYN Attack" (SYN Defender) protection for R80.20 and above

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk120476

How to configure Rate Limiting rules for DoS Mitigation (R80.20 and newer)

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk112454

Mitigation

How to configure Security Gateway to detect and prevent port scan

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk110873&partition=Advanced&product=Security

How to create and view Suspicious Activity Monitoring (SAM) Rules

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk112061

Best practice

• Set "Host Scan" and "Sweep Scan" in IPS Policy to "User Alert 1".
• In Global Settings on Smartcenter at "User Alert 1" 120 seconds blocking of source ip run via script

sam_alert -t 120 -I -src

Export Syslog Messages

Export Syslog Messages

How to export syslog messages from Gaia Security Gateway to a Log Server and view them in SmartView Tracker

https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.SearchResultMainAction&eventSubmit_doGoviewsolutiondetails=&solutionid=sk102995

Syslog from LOM Interface

At the moment it seems that syslog cannot be sent from Check Point LOM Interface.

Missing feature - Global search across multiple CMA

Preface

Before R80.x in a MDM (Multi Domain Management) you could do a search where an object is used in all the CMA's.
Until now (R80.30) this feature is not included in SmartConsole anymore.

Script solution

• https://github.com/WadesWeaponShed/Global-IP-Search-MDS
• https://community.checkpoint.com/t5/API-CLI-Discussion-and-Samples/MDS-Global-search-across-CMAs-by-IP/m-p/75906
• https://community.checkpoint.com/t5/API-CLI-Discussion-and-Samples/Search-multiple-CMA/m-p/35237

The Script

#!/bin/sh

JQ=${CPDIR}/jq/jq

OBJECT_NAME=$1
DOMAINS_FILE="domains.json"
PACKAGES_FILE="packages.json"
PACKAGE_FILE="package.json"

echo 'Getting a list of domains...'
mgmt_cli -r true -d MDS show domains limit 500 --format json > $DOMAINS_FILE
if [ $? -eq 1 ]; then
  echo "Error getting list of domains. Aborting!"
  exit 1
fi

DOMAINS_NAMES=($($JQ -r ".objects[] | .name" $DOMAINS_FILE))

echo 'Searching for object '"$OBJECT_NAME"' in all domains...'
FOUND=0
OBJECT_UID=""

for DOMAIN in ${DOMAINS_NAMES[@]}
do
  echo 'Searching in domain '"$DOMAIN"'...'
  mgmt_cli -r true -d "$DOMAIN" show objects offset 0 limit 1 in.1 name in.2 "$OBJECT_NAME" --format json > $OBJECT_NAME.json
  if [ $? -ne 1 ]; then
    OBJECT_COUNT=$($JQ -r ".total" $OBJECT_NAME.json)
    if [ $OBJECT_COUNT -ne 0 ]; then
      FOUND=1
      OBJECT_UID=$($JQ -r ".objects[0].uid" $OBJECT_NAME.json)
      echo 'Found in domain '"$DOMAIN"'!!!'
      break
    fi
  fi
done

if [ $FOUND -ne 1 ]; then
  echo 'Object '"$OBJECT_NAME"' does not exist. Aborting!'
  exit 1
fi

echo 'Searching for object '"$OBJECT_NAME"' usages in all policy packages in all domains...'
for DOMAIN in ${DOMAINS_NAMES[@]}
do
  echo 'Searching in domain '"$DOMAIN"'...'
  mgmt_cli -r true -d "$DOMAIN" show packages limit 500 --format json > $PACKAGES_FILE
  if [ $? -ne 1 ]; then
    PACKAGES_NAMES=($($JQ -r ".packages[] | .name" $PACKAGES_FILE))
    for PACKAGE in ${PACKAGES_NAMES[@]}
    do
      echo 'Searching in package '"$PACKAGE"'...'
      mgmt_cli -r true -d "$DOMAIN" show-package name $PACKAGE --format json > $PACKAGE_FILE
      if [ $? -ne 1 ]; then
        ACCESS_LAYERS=($($JQ '.["access-layers"][] | .name' -r $PACKAGE_FILE))
        for LAYER in ${ACCESS_LAYERS[@]}
        do
          mgmt_cli -r true -d "$DOMAIN" show access-rulebase package "$PACKAGE" name "$LAYER" offset 0 limit 1 filter $OBJECT_UID --format json > $OBJECT_NAME.json
          if [ $? -ne 1 ]; then
            OBJECT_COUNT=$($JQ -r ".total" $OBJECT_NAME.json)
            if [ $OBJECT_COUNT -ne 0 ]; then
              echo 'The requested object is used in policy package '"$PACKAGE"
              break
            fi
          fi
        done
      fi
    done
  fi
done

echo 'Done!'

Show logging using the web interface

If you need to view Logs over the Web in Check Point you can use SmartView.

Available since R80 but not enabled per default. In R80.10 it is enabled per default and you can access it with your SmartConsole Credentials.

It looks like this in the Browser:

Also see here: https://community.checkpoint.com/thread/5212-smartview-accessing-check-point-logs-from-web

Managing partition sizes via LVM manager on Gaia OS

Partition Resize

Since R77.30 lvm_manager is included in Gaia OS and can be used to resize logical volumes on the system.

Check Managing partition sizes via LVM manager on Gaia OS (sk95566) for more information.

Partition Sizes when installing Gaia OS

When instaling Gaia OS there is an option to change the partition sizes.
Don't use default sizes as they are for minimal usage.

Screenshot:

Check this Link: How to configure partition sizes during Gaia installation (sk92303)

SmartConsole cli parameters

In R77.30 you could use command line parameters to specify username/password like this:

FwPolicy.exe connect %Hostname% %Username%

Since R80.10 you need to do the following:

SmartConsole.exe -p SmartConsole.LoginParams

Here is the SmartConsole.LoginParams example file:

<RemoteLaunchParemeters xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema">
  <Username>admin</Username>
  <Password>password</Password>
  <ServerIP>1.2.3.4</ServerIP>
  <DomainName>LocationDomain</DomainName>
  <ReadOnly>False</ReadOnly>
  <CloudDemoMode>False</CloudDemoMode>
</RemoteLaunchParemeters>

For non-mds connection you need to leave "DomainName" field empty.

Link: https://community.checkpoint.com/thread/6432-command-line-arguments-to-r8010-smartconsoleexe

Jump to Rule Number or UID

In R80.10 you can jump directly to a rule number or a rule-UID.

With Ctrl-G you get the following:

You can copy the UID from a rule:

Or search for an rule-UID:

Perfect to use in documentations, just use the rule-UID or sometimes I also use the <FW_RuleName: FW_RuleName> Tag for documentation.

SmartConsole: Clear disconnected sessions

Howto clear disconnected sessions

If several SmartConsole disconnected (stale) sessions that cannot be discarded, see this here:

https://community.checkpoint.com/t5/General-Management-Topics/clear-disconnected-sessions/td-p/33027

Postgresql Queries

View

psql_client cpm postgres -c "select applicationname,objid,creator,state,numberoflocks,numberofoperations,creationtime,lastmodifytime
from worksession
where state = 'OPEN'
and (numberoflocks != '0'
or numberofoperations != '0');"

Clear

mgmt_cli discard --port 4434 uid 4b2ac7a8-9b0b-4e39-a3f0-4c065d631cdf
Username: admin
Password:
number-of-discarded-changes: 2
message: "OK"

Initiating manual cluster failover

This command lets you initiate a manual cluster failover (see sk55081).

Syntax

Example

[Expert@Member1:0]# cphaprob state
 
Cluster Mode:   High Availability (Active Up) with IGMP Membership
 
ID         Unique Address  Assigned Load   State          Name
 
1 (local)  11.22.33.245    100%            ACTIVE         Member1
2          11.22.33.246    0%              STANDBY        Member2
 
 
Active PNOTEs: None
 
... ...
 
[Expert@Member1:0]#
 
[Expert@Member1:0]# clusterXL_admin down
This command does not survive reboot. To make the change permanent, please run 'set cluster member admin down/up permanent' in clish or add '-p' at the end of the command in expert mode
Setting member to administratively down state ...
Member current state is DOWN
[Expert@Member1:0]#
 
[Expert@Member1:0]# cphaprob state
 
Cluster Mode:   High Availability (Active Up) with IGMP Membership
 
ID         Unique Address  Assigned Load   State          Name
 
1 (local)  11.22.33.245    0%              DOWN           Member1
2          11.22.33.246    100%            ACTIVE         Member2
 
 
Active PNOTEs: ADMIN
 
Last member state change event:
   Event Code:                 CLUS-111400
   State change:               ACTIVE -> DOWN
   Reason for state change:    ADMIN_DOWN PNOTE
   Event time:                 Sun Sep  8 19:35:06 2019
 
Last cluster failover event:
   Transition to new ACTIVE:   Member 1 -> Member 2
   Reason:                     ADMIN_DOWN PNOTE
   Event time:                 Sun Sep  8 19:35:06 2019
 
Cluster failover count:
   Failover counter:           2
   Time of counter reset:      Sun Sep  8 16:08:34 2019 (reboot)
 
[Expert@Member1:0]#
 
[Expert@Member1:0]# clusterXL_admin up
This command does not survive reboot. To make the change permanent, please run 'set cluster member admin down/up permanent' in clish or add '-p' at the end of the command in expert mode
Setting member to normal operation ...
Member current state is STANDBY
[Expert@Member1:0]#
 
[Expert@Member1:0]# cphaprob state
 
Cluster Mode:   High Availability (Active Up) with IGMP Membership
 
ID         Unique Address  Assigned Load   State          Name
 
1 (local)  11.22.33.245    0%              STANDBY        Member1
2          11.22.33.246    100%            ACTIVE         Member2
 
 
Active PNOTEs: None
 
Last member state change event:
   Event Code:                 CLUS-114802
   State change:               DOWN -> STANDBY
   Reason for state change:    There is already an ACTIVE member in the cluster (member 2)
   Event time:                 Sun Sep  8 19:37:03 2019
 
Last cluster failover event:
   Transition to new ACTIVE:   Member 1 -> Member 2
   Reason:                     ADMIN_DOWN PNOTE
   Event time:                 Sun Sep  8 19:35:06 2019
 
Cluster failover count:
   Failover counter:           2
   Time of counter reset:      Sun Sep  8 16:08:34 2019 (reboot)
 
[Expert@Member1:0]#

How to migrate Custom Queries from one SmartView Tracker to another

Problem

To do administration of IPS and other modules of the check point firewall, you often need to check logs with smartlog queries.
These queries are saved then to favorites for later use.

Migration

To migrate these queries to a new user account on the same management server or to another smartview tracker you need to know where this data is stored.

The favorites queries data is stored here:

$SMARTLOGDIR/data/users_settings/<username>/Bookmarks_Custom.xml

The file Bookmarks_Custom.xml can just be copied to the location of the new user.
After a restart of the smartconsole the favorite queries are visible again.

Links

More info also here in sk39268

Check Point Log Export

Solution

Check Point "Log Exporter" is an easy and secure method for exporting Check Point logs over the syslog protocol. It is integrated in Version R80.20 or higher.

Example

Basic Log Export to another syslog Server

cp_log_export add name SyslogToSplunk target-server <ip|hostname> target-port <port> protocol tcp format splunk

Show existing config

cp_log_export show

name: SyslogToSplunk
      enabled: true
      target-server: 1.2.3.4
      target-port:  8514
      protocol: tcp
      format: splunk
      read-mode: semi-unified
      export-attachment-ids: false
      export-link: false
      export-attachment-link: false
      time-in-milli: false
      export-log-position: Not configured, using default
      encrypted: true
      reconnect-interval: Not configured, using default

Filter example (Log only drop and reject messages)

cp_log_export set name SyslogToSplunk filter-action-in "drop,reject"

cp_log_export restart

Link

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122323

Troubleshooting

After policy install: UDP packet that belongs to an old session drops

Problem description

At the customer site we have a rule which allows a WLAN Controller to connect to the RADIUS Server in another network.
After installing the rules, the UDP connections were rematched because it is the needed global Setting on this Firewall.

With fw ctl zdebug drop we see the following:

;[vs_1];[tid_0];[fw4_0];fw_log_drop_ex: Packet proto=17 10.1.1.1:57056 -> 10.45.99.40:1812 dropped by fw_handle_old_conn_recovery Reason: UDP packet that belongs to an old session;

So the RADIUS Connection will not come up again.
It seems to be a virtual UDP session in the state table of the fw.
This UDP connection will never reach the timeout and will never be removed from the state table.

Troubleshooting

In the RADIUS service object "NEW-RADIUS" set "Keep connections open after the policy has been installed" but this does not help.

Problem is described here: https://www.cpug.org/forums/showthread.php/22042-ClusterXL-connection-drop-when-Policy-Push

Workaround

Disable the RADIUS server for 2 minutes and the Connections do work again.

Solution

Solution is described here:
Dropped UDP Server to Client packets refresh the connection timeout (sk121933)

Fixed in Hotfix for current installed release or future Jumbo Hotfix from CP.

How to copy a file from a Check Point firewall

For troubleshooting you need sometime to transfer files from a Check Point firewal, as example tcpdump files etc.
With the admin user it is not possible to login with sftp, the shell for the user is set to /etc/cli.sh.

For a temporary access to the sftp feature you need to change the shell of the admin or other user which is used for the filetransfer with sftp.

Change the shell of the user

[Expert@fw]# chsh username
Changing shell for username.
New shell [/etc/cli.sh]: /bin/bash
Shell changed.

Then you can do the transfer.

Change it back again if needed

[Expert@fw]# chsh username
Changing shell for username.
New shell [/bin/bash]: /etc/cli.sh
Shell changed.

CPView Utility and High Load Traffic

If you have the situation and a fw has a high load on traffic sometimes you need tools to figure it out what causes the resulting high cpu load etc.

A great tool to use is Check Point's CPView:

https://community.checkpoint.com/videos/5977-the-cpview-utility

How to use CPView to get History data

Start the cpview history daemon

# cpview history on

Check the status of the history daemon

# cpview history stat

history daemon is activated

Check the history data (use <+> or <-> to scroll the time)

# cpview -t

Jump directly to timestamp

Start cpview -t for the history mode.

Then press 't' to toggle the date mode and insert the date you want to start at.

IPS Troubleshooting

IPS Profile and Detect Mode

When you run the IPS recommended profile, most of the critical and high signatures are in inactive or detect mode.
But still there could be a high cpu performance impact even when you're only in detect mode.

In prevent mode you kill the connection and you are done.
In detect mode you have to keep the connection open and keep spending CPU cycles on tracking that traffic.

So detect mode maybe is using higher cpu cycles.

R80.x Performance Tuning Tip - DDOS

See: https://community.checkpoint.com/docs/DOC-3407-r80x-performance-tuning-tip-ddos-fw-sam-vs-fwaccel-dos

R80.10 IPS Best Practices

CP_R80.10_IPS_BestPractices_Guide.pdf

Limitation of 251 Inline Layers

Problem

Policy push fails with the following error: Policy installation failed on gateway. If the problem persists contact Check Point support (Error code: 2000232)

Cause

The user has configured too many policy layers in the rulebase (a layer is either an Ordered layer or an Inline Layer).

The Security Gateway has a limitation of 251 layers (in total there are 256, while 5 are reserved).

Solution

Verify that the number of layers is not exceeding 251.

Troubleshooting

Show Access Layers

mgmt_cli show access-layers limit 500 -s id.txt --format json | jq '."access-layers"[].name'

Count Access Layers

mgmt_cli show access-layers limit 500 --format json

Output:

.
.
 } ],
 "from" : 1,
 "to" : 260,
 "total" : 260
}

See here: Show Access Layers

Packetpushers with SQLNet

If you need to apply an ALG (Application level gateway) on SQLNet be careful and check the following:

SQL*Net (a.k.a Oracle TNS) and firewalls…

Most vendor’s firewalls have a SQL ALG that handles SQL*Net traffic.
They listen on TCP port 1521.

SQL*Net is based on Oracle’s TNS protocol.
The specification for this protocol is proprietary and inaccessible, but you can figure it out by reading Oracle’s docs and looking at the Wireshark dissector source code.

In Checkpoint firewalls, there are two ALGs for SQL*Net: “sqlnet1” and “sqlnet2.”
sqlnet1 should be used for non-redirected sessions and sqlnet2 should be used for redirected sessions.
The implication is that non-redirected sessions evaluated against sqlnet2 could negatively impact the CPU of the firewall. 

Show interface speed and duplex as a list

If you need a list of interfaces and the actual speed and duplex settings use this:

# ifconfig -a | grep encap | awk '{print $1}' | grep -v lo | grep -v bond | grep -v ":" \
| grep -v ^lo | xargs -I % sh -c 'ethtool %; ethtool -i %' | grep '^driver\|Speed\|Duplex\|Setting' \
| sed "s/^/ /g" | tr -d "\t" | tr -d "\n" | sed "s/Settings for/\nSettings for/g" \
| awk '{print $5 " "$7 "\t " $9 "\t" $3}' | grep -v "Unknown" | grep -v "\."

Found here: https://community.checkpoint.com/thread/7056-interface-speed-and-duplex-as-list

VPN Troubleshooting

VPN Problems

Links & Infos

IKEv2

Internet Key Exchange Protocol Version 2 (IKEv2)
https://tools.ietf.org/html/rfc5996

Check Point Probleme mit IKEv2

Site to Site using IKEv2 fails with "None of the traffic selectors match the conection"
https://support.checkpoint.com/results/sk/sk157473

How do I change the local id for an IKEv2 IPsec VPN?
https://community.checkpoint.com/t5/Remote-Access-VPN/How-do-I-change-the-local-id-for-an-IKEv2-IPsec-VPN/m-p/14786

Unauthorized VPN access to internal networks via IKEv2 tunnel (CVE-2019-8456)
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk149892

IKEv2 negotiation for Site-to-Site VPN tunnel with 3rd party peer fails if IKEv2 SA payload contains more than 8 proposals
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk112139

When Check Point peer is initiator of IKEv2 negotiation, FQDN not being sent
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk108817

Debugging IKEv2 on Check Point

Link

What is the IKEView Utility ?
https://support.checkpoint.com/results/sk/sk30994

How to collect a debug for VPN issues
https://support.checkpoint.com/results/sk/sk180488

Debugging Description

• Use Ike debug to validate and understand how both devices are negotiating the parameters

disable acceleration if you can:

fwaccel off
vpn debug trunc ALL=5
ike debug trunc
ike debug on TDERROR_ALL_ALL=5

Get the file $FWDIR/log/legacy_ikev2.xmll and check the proposal for both side.
Read the file $FWDIR/log/vpnd.elg and try to find any inconsistencies.

• IKE is the same for all players, the problem is configuration. Many times, the devices try to send parameters differently of what you expect they do.
• Check Point firewalls try to summarize the networks inside the encryption domain, this is called supernetting.
  It will try to summarize at maximum possible and will send that summarization in place of original one.
  If you have two subnets /24 it will try to send a /23.
• Route based VPN is more flexible than domain based and you can have both configured. Use it if you can.
• There's a new version for ikeview.exe capable to read $FWDIR/log/ikev2.xmll. (https://support.checkpoint.com/results/sk/sk30994)
  Check on support center and if possible use its the best tool to troubleshoot VPN problems on Check Point side.
• Disable debug after all

fwaccel on
vpn debug off

Threat Extraction Troubleshooting

Introduction

The following is a collection of troubleshooting I need to do with Check Point Threat Extraction R80.10.
I used the Technical Reference Guide (ATRG) here: sk114807

Workflow in MTA mode

1. A PostFix server receives and handles the emails.
    
2. Emails are forwarded to the in.emaild.mta daemon, which:
   1. Parses the emails (For example, Base64 decode)
   2. Passes the attachments to the scrubd process, if needed (based on the configuration of supported file types).
       
3. The scrubd process handles the file and sends it to the scrub_cp_file_convertd process with the relevant details (according to the policy).
    
4. scrub_cp_file_convertd process
   1. Converts the file / extracts potentialy malicious content from it. 
   2. Returns a Safe copy of the file to scrubd.
       
5. The scrubd process returns the Safe copy to the in.emaild.mta daemon
    
6. The in.emaild.mta daemon:
   1. Replaces the original attachment with the Safe Copy version.
       
   2. Forwards the email to its destination.

Note: For environments with MTA bundle R80.10 jhf or R80.20, in.emaild.mta is replaced with mtad daemon

Check log of convert to PDF process

It seems that the path is wron documented in the sk114807

The path mentioned /var/log/jail/$FWDIR/log/scrub_cp_file_convertd.elg* is in real /var/log/jail/$CPMDIR/log/scrub_cp_file_convertd.elg*

"This notification page has expired" error in UserCheck page when a user tries to download the original file that was blocked by Threat Extraction

According to: sk106249

Symptoms

"This notification page has expired. You can safely close the page or" error in UserCheck page when a user tries to download the original attachment 7 days after receiving the original e-mail, although the Threat Extraction is configured to keep the original attachments for more than 7 days.

• Attachment file still exists in /var/log/scrub/repository/ on Threat Extraction Gateway.
• The original mail can be retrieved by running the following command on the Security Gateway: scrub send_orig_email <email_id or reference_number> all.
• The Email ID or reference number can be retrieved from the incident log.

Solution

For more information about the sk106249 you need to login to CP support portal. There you will need to check more files if you have set the "Delete stored original files older than" to 30+ days.
These files ave been patched if you have installed the latest R80.10 Jumbo hotfixes.

The next SK mentioned is the following:

Persistence of UserCheck incidents is not preserved when quarantine time is very high
sk122099

The solution for the SK above is to upgrade to R80.20

Links & Tools

Check Point Links & Tools

Blogs

• https://yurisk.info/category/checkpoint-ngngx.html
• https://checkpoint.engineer/
• https://checkpointengineer.com/

Architecture

• Ports Used for Communication by Various Check Point Modules
• R80.x Security Gateway Architecture (Logical Packet Flow)

Operating

• Domain Objects (FQDN) - deep dive
  • https://community.checkpoint.com/docs/DOC-3476-domain-objects-fqdn-an-unofficial-atrg
• GAIA REST-API
  • https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk143612

Troubleshooting

• Connectivity issues after policy install (sk103598)
• GAIA Automated health check (sk121447)

Tools

• Diagnosticsview - CPInfo Viewer

CLI

• Top Check Point CLI commands
  • https://community.checkpoint.com/thread/5319-my-top-3-check-point-cli-commands
  • https://www.51sec.org/2015/10/advanced-checkpoint-gaia-cli-commands-tips-and-tricks/
• Common Check Point Commands (ccc) - Bash Script with all useful commands about check point
  • https://community.checkpoint.com/docs/DOC-2214-common-check-point-commands-ccc
• fw ctl zdebug commands
  • https://community.checkpoint.com/docs/DOC-2982-fw-ctl-zdebug-helpful-command-combinations
• fw monitor cheat sheet
  • http://www.roesen.org/files/fw_monitor.pdf
  • https://community.checkpoint.com/docs/DOC-3475-r8020-update-cheat-sheet-fw-monitor

Certification

• CCSM Certification R80 Overview

IPS

• IPS Protections in Detect (Staging)
• R80 Threat Prevention Best Practice
• R80.10 IPS Best Practice (PDF)