Sunday, March 23, 2025



How to run a windows VM in Apple macOS ARM Processor (Tested in M2) ?


Here are the steps - 

1. install vmware fusion, you need a Broadcom account to download the software. Unlike old times, no more pro version and no more workstation software. Its just vmware fusion now.

2. After you install vmware fusion, download windows 11 image from microsoft,

3. Create a vm using that image downloaded

During the installation (at the end), it will complain that there is no driver for NIC, its tricky to get through that window, here is a steps


4. Important Step -   

Press Shift + F10 for the command prompt (sometimes Control + Shift + F10). Remember your Mac may expect you to use Fn for the F10 key to work.

Enter oobe\BypassNRO in the command prompt and press Enter.

The VM will reboot and get back to the Internet Connection screen, however this time you will be able to skip it.


5. Once you boot the Machine at later point Install VMWare tools afterwards, you need a reboot at this point.

6. At this you have internet on the vm machine.

Monday, December 16, 2024

Active Directory Security Event IDs Used by PaloAlto User-ID Agent 



Environment -

  • Windows based User-ID Agent.
  • All version.

2000 - 2003:

SUCCESS_NET_LOGON = 540
AUTH_TICKET_GRANTED = 672
SERVICE_TICKET_GRANTED = 673
TICKET_GRANTED_RENEW = 674 


2008 and above:

LOGON_SUCCESS_W2008 = 4624
AUTH_TICKET_GRANTED_W2008 = 4768
SERVICE_TICKET_GRANTED = 4769
TICKET_GRANTED_RENEW_W2008 = 4770 

Monday, August 26, 2024

 What would you do ?

At time, we have get into unprecedented situations that you need to compare two repos (I know, thats not how repos should be maintained, but it is what it is)

So, in that case here is how you will dodge through


git remote add -f b path/to/repo_b.git git remote update git diff master remotes/b/master git remote rm b

Friday, December 15, 2023

 What would you do  ?


 What would you do when there is no telnet client enabled but you want to test a port, most of the linux clients are installed with curl, in that case we can use curl to achieve the same.


curl -v telnet://x.x.x.x:22
* About to connect() to x.x.x.x port 22 (#0)
* Trying x.x.x.x...
* Connected to x.x.x.x (x.x.x.x) port 22 (#0)
SSH-y.0-OpenSSH_y.y

Thursday, October 26, 2023

How to connect a PaloAlto VM in GN3 running in Linux


Assumption -  PaloAlto Management IP (default) : 192.168.1.1/24

 

sudo ip tuntap add name tap0 mode tap

sudo ip addr add 192.168.1.100/24 dev tap0

sudo ip link set dev tap0 up

 

Verify the adpater configs using "ip address" command in terminal. Once confirmed - 

1. Connect Add tap0 adpater to gns3 cloud

2. Connect Tap0 adapter in cloud to PA VM using GN3 Links

At this point in time, you will be able to connect Palo Alto GUI from Webbrowser in Linux machine

Tuesday, August 30, 2022


Visual Studio Code : How to se the new line character

Many of the systems want to see Unix type of files and it will throw errors with windows style end of line sequence

  




Thursday, July 9, 2020

How to remediate and test TMUI RCE vulnerability CVE-2020-5902 ?

How to remediate and test TMUI RCE vulnerability

CVE-2020-5902 ?


F5 Codes affected :
11.x to 15.x except 15.1.0.4, 14.1.2.6, 13.1.3.4, 12.1.5.2 and  11.6.5.2

How to test you are affected with this vulnerability?
https:///tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/passwd
https:///tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/etc/hosts
https:///tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.license
https:///tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp?fileName=/config/bigip.conf
https:///tmui/login.jsp/..;/tmui/locallb/workspace/tmshCmd.jsp?command=list+auth+user+admin

How to fix this ?
Ofcoz its a code upgrade to the fixed version, but its not easy to plan this over night...

What would be the workaround ?
It’s a 3-step approach (as of now), priority in order....

1.       Secure your Self IP with Port lockdown enabled, set to none (preferably) or custom as per requirements (don’t allow configuration utility ports, usually 443 or 8443 (for BIG-IP 13.x Single NIC BIG-IP Virtual Edition (VE)). This will help to avoid any attacks by exploiting this vulnerability from INTERNET.

2.       Allow management access only from a secure network.

3.       Enable location match settings (This is not covering all, not every effective completely. However, better than nothing), regex to match is  was  ".*\.\.;.*" and later corrrect to ";"

However, this can be still exploited as per the latest research. 

a.       edit /sys httpd all-properties

b.       replace the line “include none” by following and save the file
c.       save /sys config

d.       restart sys service httpd

How to check the attempts of exploitation ?

Versions till  to 14.1.0:

In versions earlier than 14.1.0, with the default configuration, you can check logs in /var/log/audit and /var/log/ltm as follows. 

grep -i '%tmui' /var/log/audit
grep -i '%tmui' /var/log/ltm

Log entries similar to the following are an indication of possible compromise:
audit.1:Jul  7 18:43:12 [REDACTED] notice tmsh[27903]: 04426005:5: AUDIT - Cannot load user credentials for user "%tmui" Current session has been terminated.
ltm.1:Jul  7 18:43:12 [REDACTED] notice tmsh[27903]: 04426006:5: Cannot load user credentials for user "%tmui" Current session has been terminated.

Versions 14.1.0 and up

In version 14.1.0 and up, you can examine the output of journalctl for evidence of attempts to exploit this vulnerability by issuing the command bash

journalctl /bin/logger | grep -F ';'

Output may appear similar to the following example on a device
Jul 07 22:23:07 hostname logger[29929]: [ssl_acc] nnn.nnn.nnn.nnn - - [07/Jul/2020:22:23:07 +0000] "/[REDACTED]/..;/[REDACTED]" 200 252

If any log entries are visible similar to above, it's an indication of exploiting the BIG-IP system.



Last but not the least, its always a good idea to chain of security (multi vendor), so that you will not get hit by a vulnerability directly, eg: FW ->IPS->BIGIP in this case.... Sigh!


Tuesday, June 23, 2020

cURL : How do you highjack DNS when there is no permission

Recently, I have landed on an issue, and I need to test a https domain by "hijacking" the DNS (I am getting a different IP being in a different part of the world)

So I decided to use my favorite tool curl with "-H" or --header option, No Luck. And I understand we need to manipulate the SNI. Host entry is the best way, but what if you are not a privileged user... sigh

But, here is the Panacea to address this convoluted issue  - "Lickety-Split"

curl --resolve domainname:port:ipaddress https://url/path


curl --resolve xyx.test.com:443:1.1.1.1 https://xyx.test.com/path

Tuesday, December 17, 2019

R80.40 is in GA

R80.40 EA is available now and seems interesting, especially on the supported migrations and  IOT Security.

After all, we have a new Kernel: TL:DR



IoT Security
A new IoT security controller to:
  • Collect IoT devices and traffic attributes from certified IoT discovery engines (currently supports Medigate, CyberMDX, Cynerio, Claroty, Indegy, SAM and Armis). 
  • Configure a new IoT dedicated Policy Layer in policy management.
  • Configure and manage security rules that are based on the IoT devices' attributes.                      
TLS Inspection
HTTP/2
  • HTTP/2 is an update to the HTTP protocol. The update provides improvements to speed, efficiency and security and results with a better user experience. 
  • Check Point's Security Gateway now support HTTP/2 and benefits better speed and efficiency while getting full security, with all Threat Prevention and Access Control blades, as well as new protections for the HTTP/2 protocol.
  • Support is for both clear and SSL encrypted traffic and is fully integrated with HTTPS/TLS
  • Inspection capabilities.                      
TLS Inspection Layer
This was formerly called HTTPS Inspection. Provides these new capabilities:
  • A new Policy Layer in SmartConsole dedicated to TLS Inspection.
  • Different TLS Inspection layers can be used in different policy packages.
  • Sharing of a TLS Inspection layer across multiple policy packages.
  • API for TLS operations.
Threat Prevention
  • Overall efficiency enhancement for Threat Prevention processes and updates.
  • Automatic updates to Threat Extraction Engine.
  • Dynamic, Domain and Updatable Objects can now be used in Threat Prevention and TLS Inspection policies. Updatable objects are network objects that represent an external service or a known dynamic list of IP addresses, for example - Office365 / Google / Azure / AWS IP addresses and Geo objects.
  • Anti-Virus now uses SHA-1 and SHA-256 threat indications to block files based on their hashes. Import the new indicators from the SmartConsole Threat Indicators view or the Custom Intelligence Feed CLI.
  • Anti-Virus and SandBlast Threat Emulation now support inspection of e-mail traffic over the POP3 protocol, as well as improved inspection of e-mail traffic over the IMAP protocol.
  • Anti-Virus and SandBlast Threat Emulation now use the newly introduced SSH inspection feature to inspect files transferred over the SCP and SFTP protocols.
  • Anti-Virus and SandBlast Threat Emulation now provide an improved support for SMBv3 inspection (3.0, 3.0.2, 3.1.1), which includes inspection of multi-channel connections. Check Point is now the only vendor to support inspection of a file transfer through multiple channels (a feature that is on-by-default in all Windows environments). This allows customers to stay secure while working with this performance enhancing feature.
Access Control
Identity Awareness
  • Support for Captive Portal integration with SAML 2.0 and third party Identity Providers.
  • Support for Identity Broker for scalable and granular sharing of identity information between PDPs, as well as cross-domain sharing. 
  • Enhancements to Terminal Servers Agent for better scaling and compatibility.
IPsec VPN
  • Configure different VPN encryption domains on a Security Gateway that is a member of multiple VPN communities. This provides: 
    • Improved privacy - Internal networks are not disclosed in IKE protocol negotiations.
    • Improved security and granularity - Specify which networks are accessible in a specified VPN community.
    • Improved interoperability - Simplified route-based VPN definitions (recommended when you work with an empty VPN encryption domain).
  • Create and seamlessly work with a Large Scale VPN (LSV) environment with the help of LSV profiles.
URL Filtering
  • Improved scalability and resilience.
  • Extended troubleshooting capabilities.

NAT
  • Enhanced NAT port allocation mechanism - on Security Gateways with 6 or more CoreXL Firewall instances, all instances use the same pool of NAT ports, which optimizes the port utilization and reuse.
  • NAT port utilization monitoring in CPView and with SNMP.

Voice over IP (VoIP)
Multiple CoreXL Firewall instances handle the SIP protocol to enhance performance.

Remote Access VPN
Use machine certificate to distinguish between corporate and non-corporate assets and to set a policy  enforcing the use of corporate assets only. Enforcement can be pre-logon (device authentication only) or post-logon (device and user authentication).

Mobile Access Portal Agent
Enhanced Endpoint Security on Demand within the Mobile Access Portal Agent to support all major web browsers. For more information, see sk113410.

Security Gateway and Gaia
CoreX L and Multi-Queue
  • Support for automatic allocation of CoreXL SNDs and Firewall instances that does not require a Security Gateway reboot.
  • Improved out of the box experience - Security Gateway automatically changes the number of CoreXL SNDs and Firewall instances and the Multi-Queue configuration based on the current traffic load.
Clustering
  • Support for Cluster Control Protocol in Unicast mode that eliminates the need for CCP
Broadcast or Multicast modes.
  • Cluster Control Protocol encryption is now enabled by default.
  • New ClusterXL mode -Active/Active, which supports Cluster Members in different geographic locations that are located on different subnets and have different IP addresses.
  • Support for ClusterXL Cluster Members that run different software versions.
  • Eliminated the need for MAC Magic configuration when several clusters are connected to the same subnet.
VSX
  • Support for VSX upgrade with CPUSE in Gaia Portal.
  • Support for Active Up mode in VSLS.
  • Support for CPView statistical reports for each Virtual System

Zero Touch
A simple Plug & Play setup process for installing an appliance - eliminating the need for technical expertise and having to connect to the appliance for initial configuration.
Gaia REST API
Gaia REST API provides a new way to read and send information to servers that run Gaia Operating System. See sk143612.
Advanced Routing
  • Enhancements to OSPF and BGP allow to reset and restart OSPF neighboring for each CoreXL Firewall instance without the need to restart the routed daemon.
  • Enhancing route refresh for improved handling of BGP routing inconsistencies.

New kernel capabilities
  • Upgraded Linux kernel
  • New partitioning system (gpt):
  • Supports more than 2TB physical/logical drives
  • Faster file system (xfs)
  • Supporting larger system storage (up to 48TB tested)
  • I/O related performance improvements
  • Multi-Queue:
  • Full Gaia Clish support for Multi-Queue commands
  • Automatic "on by default" configuration
  • SMB v2/3 mount support in Mobile Access blade
  • Added NFSv4 (client) support (NFS v4.2 is the default NFS version used)
  • Support of new system tools for debugging, monitoring and configuring the system

CloudGuard Controller
  • Performance enhancements for connections to external Data Centers.
  • Integration with VMware NSX-T.
  • Support for additional API commands to create and edit Data Center Server objects.

Security Management
Multi-Domain Server
  • Back up and restore an individual Domain Management Server on a Multi-Domain Server.
  • Migrate a Domain Management Server on one Multi-Domain Server to a different Multi-Domain Security Management.
  • Migrate a Security Management Server to become a Domain Management Server on a Multi-Domain Server.
  • Migrate a Domain Management Server to become a Security Management Server.
  • Revert a Domain on a Multi-Domain Server, or a Security Management Server to a previous revision for further editing.
SmartTasks and API
  • New Management API authentication method that uses an auto-generated API Key.
  • New Management API commands to create cluster objects.
  • Central Deployment of Jumbo Hotfix Accumulator and Hotfixes from SmartConsole or with an API allows to install or upgrade multiple Security Gateways and Clusters in parallel.
  • SmartTasks - Configure automatic scripts or HTTPS requests triggered by administrator tasks, such as publishing a session or installing a policy.
Deployment
Central Deployment of Jumbo Hotfix Accumulator and Hotfixes from SmartConsole or with an API allows to install or upgrade multiple Security Gateways and Clusters in parallel.

SmartEvent
Share SmartView views and reports with other administrators.

Log Exporter
Export logs filtered according to field values.

Endpoint Security
  • Support for BitLocker encryption for Full Disk Encryption.
  • Support for external Certificate Authority certificates for Endpoint Security client
  • authentication and communication with the Endpoint Security Management Server.
  • Support for dynamic size of Endpoint Security Client packages based on the selected
  • features for deployment.
  • Policy can now control level of notifications to end users.
  • Support for Persistent VDI environment in Endpoint Policy Management.

Tuesday, July 3, 2018

How to connect to wifi from Raspberry Pi - CLI


Although there are easy ways connect to wifi using "sudo raspi-config" , I have decided to stick with CLI so that we will know what is happening behind the fancy screens ;) Come on, you dont get high when it is easy :).

On a serious note, it doesnt encypt the PSK - that is the actual reason..

Following are the steps I followed  :


Step 1 - Scan the Network by issuing the following command

                sudo iwlist wlan0 scan

Step 2 - Generate an encrypted PSK (pre-encrypted 32 byte hexadecimal number) and then you will be asked for the password of the WiFi network

               wpa_passphrase



               example :

                       wpa_passphrase "test"
                                   
                       Then you will be asked for the password of the WiFi network (in this case  testingPassword). The output is as follows:

  network={
      ssid="test"
      #psk="testingPassword"
      psk=131e1e221f6e06e3911a2d11ff2fac9182665c004de85300f9cac208a6a80531
  }

You can ideally copy paste this to /etc/wpa_supplicant/wpa_supplicant.conf, but one should be nuts id you don't delete the clear text password (commented in above example)

Also, you can do this in a diff way when you are more lazy (again delete the clear text as needed, dont be that ;))

sudo su

wpa_passphrase "testing" >> /etc/wpa_supplicant/wpa_supplicant.conf

Now save the file by pressing Ctrl+X, then Y, then finally press Enter.

Reconfigure the interface by issuing the following command

wpa_cli -i wlan0 reconfigure

You can verify whether it has successfully connected using ifconfig wlan0. If the inet addr field has an address beside it, the Raspberry Pi has connected to the network. If not, check that your password and ESSID are correct.

On the Raspberry Pi 3 Model B+, you will also need to set the country code, so that the 5G networking can choose the correct frequency bands. You can either use the raspi-config application and select the localisation option, or edit the  wpa_supplicant.conf file and add the following. (Note you need to replace 'GB' with the ISO code of your country. See Wikipedia for a list of country codes.)

country=US

Its time for QA - 

What about unsecured networks ?

If the network you are connecting to does not use a password, the  wpa_supplicant entry for the network will need to include the correct  key_mgmt entry. e.g.

network={
    ssid="test"
    key_mgmt=NONE
}

What about hidden networks ?

If you are using a hidden network, an extra option in the wpa_supplicant file,  scan_ssid, may help connection.

network={
    ssid="yourHiddenSSID"
    scan_ssid=1
    psk="Your_wifi_password"
}
You can verify whether it has successfully connected using ifconfig wlan0. If the inet addr field has an address beside it, the Raspberry Pi has connected to the network. If not, check your password and ESSID are correct.

What about adding multiple wireless network configurations?

On recent versions of Raspbian, it is possible to set up multiple configurations for wireless networking. For example, you could set up one for home and one for school.

For example

network={
    ssid="SchoolNetworkSSID"
    psk="passwordSchool"
    id_str="school"
}

network={
    ssid="HomeNetworkSSID"
    psk="passwordHome"
    id_str="home"
}
If you have two networks in range, you can add the priority option to choose between them. The network in range, with the highest priority, will be the one that is connected.

network={
    ssid="HomeOneSSID"
    psk="passwordOne"
    priority=1
    id_str="homeOne"
}

network={
    ssid="HomeTwoSSID"
    psk="passwordTwo"
    priority=2
    id_str="homeTwo"
}

Finally, what about me ? 


Well, thats THE same... Still counting on you, will try my best before I call it..... On a serious note, that was a silly question, seldom cares.. Thanks for asking - see you next time ?


Courtesy: https://wiki.debian.org/WiFi/HowToUse

Thursday, November 9, 2017

A Short Story on “How I saved my weekend”

After a network re-design, I started realizing that the we need to change the “vlan” of all the virtual servers we created in two F5 BigIP LTM Devices…. Sadly, we have 311 Virtual Servers in each F5 and we have two devices in scope. So, the count bumped to 622… 3 clicks per virtual server and am going click 1866 times???

No... Never…

Lazy minds always find shortcuts and I started thinking about the leadership direction, automate as much you can…

Finally, after couple sighs, I started dusting my Python skills and wrote couple of lines of code to finish my playbook, named it as ‘knock-it-down.yml’ …

Yes, it took only 45-50 mins for me to save 1866 clicks and my plans during the weekend…

It was painful to accept we lost the game, but there was a smile in my face and I was trying to hide it…

Why "fw ctl zdebug..." should not be used"

Kernel debug Best Practices or "Why "fw ctl zdebug..." should not be used"

Over last several days I have seen rapidly growing amount of posts at CPUG and CP Community where "fw ctl zdebug..." command was mentioned, used and advised.

Although some of you already know my position for the matter, I have decided to write a post about the growing custom to use zdebug instead of employing full fw ctl debug mechanism.

Kernel debug in general


Check Point FW is essentially a Linux-based system with a kernel module inserted between drivers and OS IP stack. If you do not know what I am talking about, you may want to look into this post with an explanatory video for the matter.

Extracting information about kernel based security decisions is rather tricky, so Check Point developed an elaborate tool to read some info about various FW kernel modules actions.

In a nutshell, each kernel module has multiple debug flags that force code to start printing out some information. I have numerous posts in this blog explaining different flags, tips and tricks with kernel debug and also providing links to CP kernel debug documents.

Debug buffer


It is important to understand FW kernel is always printing out some debug messages. For most of the kernel modules, error and warning flags are active, and the output goes to /var/log/messages by default. This is not practical for debug, so before starting kernel debug, an engineer needs to set a buffer which would receive debug output instead of /var/log/messages file.

To do so, the following command is used: fw ctl debug -buf XXXXX, where XXXXX is the buffer size in KB. The maximum possible buffer today is 32 MB, but I advise my students to use 99999 to make sure they get maximum buffer possible anyway.

Kernel can be very chatty, so having a bigger buffer would ensure less kernel messages being lost.

Debug modules and flags


FW kernel is a complex structure. It is built with multiple modules. Each of the modules has its own flags. One can run a single debug session with multiple flags raised for several modules. To raise debug flags, one use one or several commands of this type:

fw ctl debug -m (module name) (+|-) (list of flags)

It is essential that + and - options allow you to raise and remove flags on the fly, even during an already running debug session. List of modules and flags can be found by the first link in this post.

Printing info out of buffer


Raising flags is not enough, as to get information, you need to start reading buffer out with this command:

fw ctl kdebug -f (with some options)

There will be A LOT of information, so never do this on the console. Use SSH session or redirect to a file.

Stopping debug


Once you collected the relevant info, you need to reset kernel debug to the default settings, otherwise you FW will continue printing out tons of unnecessary info. To do so, run

fw ctl debug 0

What is fw ctl zdebug then?

fw ctl zdebug is an internal R&D macros to cut corners when developing and testing new features in the sterile environment. It is equivalent to the following sequence of commands:

fw ctl debug -buf 1024
fw ctl debug (your options)
fw ctl kdebug -f
-------(waiting for Ctrl-C)
fw ctl debug 0

Why is this a problem?


If you are still reading this post and get to this line, you probably think zdebug is a god sent miracle. It simplifies so many things, it is the only way to run debug in production environment! Right? 

Wrong. To make it plain, here is the list of problematic point with this way of doing things:

1. The buffer is way too small. Lots and lots of messages might be just lost because buffers does not have enough room to hold them before read.
2. It is not flexible enough. Running debug in production requires lots of consideration and certain amount of caution. After all, you are asking FW kernel to do extra things, lots of them. The best practice is to start with a single flag or two and expand area of research in the fly trying to catch an issue. This is impossible to do with fw ctl zdebug macros.
3. It is too simple to use. You could say, what a funny argument. Yet, let's think about it. To master kernel debug as described above, one has to understand kernel structure, dependencies, flags and modules. You don't have to do any of that to run fw ctl zdebug drop, and many people do jsut that. 

And guess what, this is also the simplest way to bring your busy production FW cluster down. So no, do not try this at home or at your place of work, if job security is important for you.

Wednesday, August 21, 2013

MS Excel - Reset Comments to Original Position

Little bit of Excel knowledge is a must thing :

I ran into an issue recently, got mail with all comments not in the right position. Following code snippet helped to survive

ATL+F7 took me to vba

Pasted the following and ran this :-

Sub ResetComments()
Dim cmt As Comment
For Each cmt In ActiveSheet.Comments
cmt.Shape.Top = cmt.Parent.Top + 5
cmt.Shape.Left = _
cmt.Parent.Offset(0, 1).Left + 5
Next
End Sub

And ofcoz Review tab helped me to hide them later :)

Understanding BIOS keywords - Dmidecode

dmidecode --type {KEYWORD / Number }
You need to pass dmidecode following keywords:
  • bios
  • system
  • baseboard
  • chassis
  • processor
  • memory
  • cache
  • connector
  • slot
All DMI types you need to use with dmidecode --type {Number}:
# TypeShort Description
0BIOS
1System
2Base Board
3Chassis
4Processor
5Memory Controller
6Memory Module
7Cache
8Port Connector
9System Slots
10On Board Devices
11OEM Strings
12System Configuration Options
13BIOS Language
14Group Associations
15System Event Log
16Physical Memory Array
17Memory Device
1832-bit Memory Error
19Memory Array Mapped Address
20Memory Device Mapped Address
21Built-in Pointing Device
22Portable Battery
23System Reset
24Hardware Security
25System Power Controls
26Voltage Probe
27Cooling Device
28Temperature Probe
29Electrical Current Probe
30Out-of-band Remote Access
31Boot Integrity Services
32System Boot
3364-bit Memory Error
34Management Device
35Management Device Component
36Management Device Threshold Data
37Memory Channel
38IPMI Device
39Power Supply
Display Power supply information, enter:
# dmidecode --type 39
Display CPU information, enter:
# dmidecode --type processor
Read man page for more information:
$ man dmidecode

I see this not working in SPLAT with type switch

Monday, August 19, 2013

BIGIP F5 Command Line (bigpipe Vs tmsh)

BIGIP F5 Command Line (bigpipe Vs tmsh)

b arp show show /net arp all
b arp all delete tmsh delete /net arp all
b class DATA-GROUP mode read modify ltm data-group DATA-GROUP access-mode read-only
b class show show running-config /ltm data-group
b cluster show show /sys cluster all-properties
b config load file.ucs load /sys ucs file.ucs
b config save file.ucs save /sys ucs file.ucs
b config sync run /cm config-sync from-group/to-group DEVICEGROUPNAME
b conn show show /sys connection
b conn show all show /sys connection all-properties Show all connection table properties
b conn ss server node-ip:node-port delete delete /sys connection ss-server-addr node-ip ss-server-port node-port Delete connection table entries for node-ip node-port
b daemon list list /sys daemon-ha all-properties
b db < key name > < value > modify /sys db < key name > value < value > Modify database values
b db Platform.PowerSupplyMonitor disable tmsh modify sys db platform.powersupplymonitor value disable Disables PSU alert if only one PSU in use on Dual PSU system
b db show show running-config /sys db -hidden all-properties
b export my.config.scf save /sys scf my.config.scf v10.x only
b export my.config.scf save /sys config file my.config.scf tar-file my.config.tar v11.0+
b failover standby run /sys failover standby v11+
b fo show show /sys failover
b fo standby run /util bigpipe fo standby v10+
b ha table show /sys ha-status all-properties
b hardware baud rate modify /sys console baud-rate v10: sol10621 | v11: sol13325
b ha table show show /sys ha-status all-properties
b httpd list list /sys httpd To list httpd configuration.
b import my.config.scf load /sys scf my.config.scf v10.x only
b import my.config.scf load /sys config file my.config.scf tar-file my.config.tar v11.0+
b interface show -j show /net interface -hidden all-properties -hidden is not tab completable, but should be shown in the command output on iHealth.
b load load sys config partitions all
b merge load /sys config merge Added in v11. In v10 use bigpipe
b merge /path/to/file.txt tmsh load /sys config file /path/to/file.txt merge Merge a file into the BIG-IP configuration. Added in v11. In v10, use bigpipe
b mgmt show show running-config /sys management-ip
b monitor show show running-config /ltm monitor (?)
b nat show show /ltm nat all or list /ltm nat all-properties The two tmsh commands are required here since b nat show will list the unit preference and ARP status. Statistical information is shown via “show” while configuration information is shown via “list”.
b node all monitor show list ltm node monitor
b node show show /ltm node
b ntp servers 10.10.10.10 modify sys ntp servers add { 10.10.10.10 }
b packet filter all show show /net packet-fliter
b partition list auth partition no “show” command yet, list will only show written partitions
b persist tmsh show ltm persistence persist-records
b platform show /sys hardware
b pool list list /ltm pool
b pool show show /ltm pool members
b profile access all stats

b profile auth all show all show /ltm auth profile all The tmsh auth command does not display associated OCSP information shown by bigpipe.
b profile http ramcache show show /ltm profile http
b profile http stats show /ltm profile http
b profile ssl stats show /ltm profile ssl
b profile persist profile_name list all tmsh list ltm persistence profile_name all-properties
b profile tcp show show /ltm profile tcp
b profile tcp stats show /ltm profile tcp
b profile udp show show /ltm profile udp
b profile udp stats show /ltm profile udp
b profile xml show show /ltm profile xml
b reset load / sys default-config v10.x
b reset load / sys config default v11.x
b route show show /net route all
b rule < rule > show all show /ltm rule < rule >
b rule show show /ltm rule all
b rule stats reset reset-stats /ltm rule < rule >
b save save sys config partitions all
b self show show running-config /net self
b snat show /ltm snat
b snatpool show show /ltm snatpool
b software show sys software
b software desired install sys software image NAME volume HDX.Y reboot
b software desired install sys software image NAME create-volume volume HDX.Y v11.0+ : Creates volume and installs software. (Cannot create empty volumes in v11)
b software desired install sys software hotfix NAME volume HDX.Y Installs desired Hotfix to the specified Volume.
b stp show show running-config /net stp all-properties
b syslog list all list sys syslog all-properties
b syslog remote server none modify sys syslog remote-servers none
b syslog remote server test-srv host 192.168.206.47 modify sys syslog remote-servers add {test-srv{host 192.168.206.47}} You can append “remote-port 517″ for example to the end of the command to specify the port
b syslog remote server test-srv local ip 172.28.72.90 modify sys syslog remote-servers modify {test-srv{local-ip 172.28.72.90}} The self ip must be non-floating
b system hostname modify sys global-settings hostname NEWHOST.EXAMPLE.COM
b trunk show -j show /net trunk -hidden all
b trunk all lacp show show /net trunk detail
b unit show

b verify load load sys config verify
b version show /sys version Takes grep (but not “head” as in “b version |head”) – for example, grep on build: tmsh show sys version |grep -i build
b virtual address show show /ltm virtual-address all-properties “show” does not show the objects used by the virtual, and list does not show statistics.
b virtual all show all show /ltm virtual all-properties or list /ltm virtual all-properties “show” does not show the objects used by the virtual, and list does not show statistics.
b vlan all show all -j show /net vlan -hidden
b vlangroup all show all show /net vlan-group all
bigstart status|start|stop|restart SERVICE_NAME show|start|stop|restart sys service SERVICE_NAME
bpsh (?) load sys config from-terminal merge