Useful CLI Commands Check Point

Cheatsheets

• Check Point CLI Reference Card (https://www.roesen.org/files/cp_cli_ref_card.pdf)
• FW Monitor (https://www.roesen.org/files/fw_monitor.pdf)
• R80 Cheat Sheet FW-Monitor (https://www.ankenbrand24.de/index.php/articles/check-point-articel/cheat-sheets/r80-cheat-sheet-fw-monitor/)
• ClusterXL Cheat Sheet (https://www.ankenbrand24.de/index.php/articles/check-point-articel/cheat-sheets/r80-cheat-sheet-clusterxl/)

CLISH Commands

To start a transaction in CLISH use start transaction.

Commands - commit, or rollback to be used to end the transaction mode. All changes made using commands in transaction mode are applied at once or none of the changes are applied based on the way transaction mode is terminated.

Show Commands

Set Commands

Generic Commands

The commands below have to be used in expert mode and NOT in clish.

Example Reset admin password without access to GW:

/sbin/grub-md5-crypt

cprid_util -server <IP_of_Gateway> -verbose rexec -rcmd /bin/clish -s -c \
'set config-lock on override'  # Ensure clish db is unlocked

cprid_util -server <IP_of_Gateway> -verbose rexec -rcmd /bin/clish -s -c \
'set user admin password-hash <Password_Hash_from_Step_above>' # Set admin user pw hash

cprid_util -server <IP_of_Gateway> -verbose rexec -rcmd /bin/clish -s -c \
'set expert-password-hash <Password_Hash_from_Step_above>' # change expert pw hash

VPN Commands

The commands below have to be used in expert mode and NOT in clish.

To view informations about VPN Tunnels

In R80+: 

• Open SmartConsole > Logs & Monitor.
• Open the catalog (new tab).
• Click Tunnel & User Monitoring.

See also: Logging and Monitoring R80.10 (Part of Check Point Infinity) 

VSX specific

The commands below have to be used in expert mode and NOT in clish

Example:

# vsx stat -v -l

VSID:            0
VRID:            0
Type:            VSX Gateway
Name:            fwvsx01
Security Policy: fwvsx01_VSX
Installed at:    21Nov2019 10:30:11
SIC Status:      Trust
Connections number: 66
Connections peak:   765
Connections limit:  14900

VSID:            1
VRID:            1
Type:            Virtual System
Name:            fw01p
Security Policy: FW_01
Installed at:    25Nov2019 11:30:39
SIC Status:      Trust
Connections number: 30628
Connections peak:   90464
Connections limit:  119900

API specific (mgmt_cli)

API Manual: https://sc1.checkpoint.com/documents/R80/APIs/index.html

The mgmt_cli tool is installed as part of Gaia on all R80 gateways and can be used in scripts running in expert mode.
The mgmt_cli.exe tool is installed as part of the R80 SmartConsole installation (typically under C:\Program Files (x86)\CheckPoint\SmartConsole\R80\PROGRAM\) and can be copied to run on any Windows machine. 

On Windows you cannot login with a certificate since the mgmt_cli_login is missing, you need to login with user/password or use the mgmt_cli tool on the management server.

To use the actual ssh login with mgmt_cli use the undocumented feature
mgmt_cli -r true

If your mgmt server is running on another port (ex. 8443) use
mgmt_cli --port 8443

Show api-settings

Check if clients are allowed to connect to the api and check all the api-settings.

mgmt_cli -r true --domain 'System Data' show api-settings


...
accepted-api-calls-from: "all ip addresses"
...

API Status

To confirm that the API is usable and available remotely, run the api status command. If Accessibility shows “Require all granted” it means that any system can access the API (on R80 this will show “Allow all”).

[Expert@awsmgmt:0]# api status

API Settings:
---------------------
Accessibility:                      Require all granted
Automatic Start:                    Enabled

Processes:

Name      State     PID       More Information
-------------------------------------------------
API       Started   14472
CPM       Started   14350     Check Point Security Management Server is running and ready
FWM       Started   13807

Port Details:
-------------------
JETTY Internal Port:      50276
APACHE Gaia Port:         443


--------------------------------------------
Overall API Status: Started
--------------------------------------------

API readiness test SUCCESSFUL. The server is up and ready to receive connections

Notes:
------------
To collect troubleshooting data, please run 'api status -s <comment>'

API Status Troubleshooting data

To create a <comment>.tgz file with troubleshooting data start

api status -s <comment>

logging in

First create a session into a file and reuse it:

mgmt_cli login user admin > id.txt

With read-only access:

mgmt_cli login user admin read-only true > id.txt

Search object in database

search objects by IP, return all objects that contain the ip explicitly or within a nework address space/range.

mgmt_cli -s id.txt show objects filter "192.168.1.1" ip-only true --format json | jq '.objects[] | {name: .name, subnet: .subnet4, mask: ."mask-length4"}'

Show access layers

mgmt_cli show access-layers limit 500 -s id.txt --format json | jq '."access-layers"[].name'

Output:
"Layer1"
"Layer2"
...

Show number of rules in policy

mgmt_cli show access-rulebase name "<layer>" -s id.txt --format json limit 1 | jq '.total'

Show access rule base

mgmt_cli show access-rulebase offset 0 limit 20 name "Network" details-level "standard" use-object-dictionary true show-hits true hits-settings.from-date "2020-01-01" hits-settings.to-date "2020-12-31T23:59" hits-settings.target "corporate-gw" --format json

Display rule with explicit uid

mgmt_cli -s id.txt show access-rule layer "My_policy Network" uid "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx"

Show unused objects in objects-db

mgmt_cli show unused-objects offset 0 limit 50 details-level "standard" -s id.txt --format json

Show changes from who and when in objects-db

mgmt_cli show changes from-date "2019-04-11T08:20:50" to-date "2019-04-15" -s id.txt --format json

Run script on firewall

https://sc1.checkpoint.com/documents/latest/APIs/index.html#web/run-script~v1.6%20

mgmt_cli run-script script-name "ifconfig" script "ifconfig" targets.1 "corporate-gateway" -s id.txt --format json

Show application-site URLs

mgmt_cli show application-site name "HTTPS Pass Through Global" details-level "standard" -s id.txt --version 1.2 --format json

Show VPN communities

mgmt_cli -r true show vpn-communities-star details-level full -s id.txt --format json

mgmt_cli -r true show vpn-communities-meshed details-level full -s id.txt --format json

Count and show access-layers (Inline Layers)

mgmt_cli show access-layers limit 500 --format json

Output:

.
.
 } ],
 "from" : 1,
 "to" : 260,
 "total" : 260
}

Links

http://sicuriconnoi.blogspot.com/2017/11/top-checkpoint-cli-commands.html

Check Point stattest Utility for OID Troubleshooting on GW
https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_CLI_ReferenceGuide/Content/Topics-CLIG/FWG/stattest.htm