Understanding BIOS keywords - Dmidecode

dmidecode --type {KEYWORD / Number }

You need to pass dmidecode following keywords:

• bios
• system
• baseboard
• chassis
• processor
• memory
• cache
• connector
• slot

All DMI types you need to use with dmidecode --type {Number}:

# Type	Short Description
0	BIOS
1	System
2	Base Board
3	Chassis
4	Processor
5	Memory Controller
6	Memory Module
7	Cache
8	Port Connector
9	System Slots
10	On Board Devices
11	OEM Strings
12	System Configuration Options
13	BIOS Language
14	Group Associations
15	System Event Log
16	Physical Memory Array
17	Memory Device
18	32-bit Memory Error
19	Memory Array Mapped Address
20	Memory Device Mapped Address
21	Built-in Pointing Device
22	Portable Battery
23	System Reset
24	Hardware Security
25	System Power Controls
26	Voltage Probe
27	Cooling Device
28	Temperature Probe
29	Electrical Current Probe
30	Out-of-band Remote Access
31	Boot Integrity Services
32	System Boot
33	64-bit Memory Error
34	Management Device
35	Management Device Component
36	Management Device Threshold Data
37	Memory Channel
38	IPMI Device
39	Power Supply

Display Power supply information, enter:
# dmidecode --type 39
Display CPU information, enter:
# dmidecode --type processor
Read man page for more information:
$ man dmidecode

I see this not working in SPLAT with type switch

Migration from SecurePlatform to Gaia

Solution ID: sk68140 Product: Security Gateway, Security Management, SecurePlatform Version: R75.40 OS: Gaia Platform / Model: All

Solution 

This solution describes a method for performing a migration from SecurePlatform to Gaia.
For example, when you want to replicate machine A (running SecurePlatform) onto machine B (running Gaia).

Important: The process described in this page handles operating system configuration only. Security Gateway migration is a different process, which is not discussed in this page.

Steps

1. Export the SecurePlatform configuration into a tarball.
2. Copy the tarball into the Gaia machine and extract the files.
3. Run the Gaia converter on the SecurePlatform configuration files, to generate a clish script.
4. Load the clish script into Gaia.

Step 1 - Export SecurePlatform configuration

You can do it in two ways:

1. The recommended way is copying the configuration files directly, because it does not involve a cpstop and can be run on a production machine. You can use the copyfiles script to copy the files to a tarball.
2. Get the files is through backup of SecurePlatform. This involves stopping the firewall (cpstop).

Step 2 - Copy the file into the Gaia machine

Copy the files from Step 1 into the Gaia machine, and put them in a directory.

Step 3 - Run the Gaia converter

Run the converter utility in the same directory where you put the SecurePlatform configuration files.

Example:

clish> expert

Enter expert password:

bash> converter -o myconfig

The resulting myconfig script contains clish commands that can be run in Gaia to replicate the same OS configuration.

Step 4 - Load the clish script

There are two ways to do it:

1. The recommended way is to put the clish script in your home directory, and then run the following four commands:
   
   clish> set clienv on-failure continue
   clish> load configuration myconfig
   clish> set clienv on-failure stop
   clish> save config 

1. Run the clish with a script like this:
   bash> clish -fi myconfig
   bash> clish -c "save config"

Note: The following files are processed by the Gaia converter.

Feature	File name
Interfaces and routing	/etc/sysconfig/netconf.C
	/etc/sysconfig/network
Known hosts	/etc/hosts
	/etc/hosts.allow
Passwords	/etc/shadow
User accounts	/etc/passwd
Known DNS servers	/etc/resolv.conf
	/etc/sysconfig/external.if
DHCP client	/etc/dhcpd.conf
DHCP server	/etc/sysconfig/dhcpd
DHCP relay	/etc/sysconfig/dhcrelay
Cron jobs	/var/spool/cron/root
NTP client	/etc/sysconfig/ntp
	/opt/spwm/conf/cp_http_admin_server.conf
Known RADIUS servers	/etc/raddb/server
RADIUS groups	/etc/raddb/groups
	/etc/sysconfig/ethtab
Syslog	/etc/sysconfig/syslog
Syslog	/etc/syslog.conf
ARP dynamic cache size	/proc/sys/net/ipv4/neigh/default/gc_thresh3

NIC status in Linux

#!/bin/bash

NICLIST=`ifconfig | egrep '^eth[0-9] ' | awk '{ print $1 }'`


for nics in $NICLIST
do
niclink=(`ethtool $nics | awk '/Duplex/ { duplex=$2 }; /Link detected/ { link=$3 }; /Speed/ { speed=$2 } END { print link " " speed " " duplex }'`)

if [ "${niclink[0]}" = "yes" ]; then
speed="${niclink[1]}"
duplex="${niclink[2]}"
fi

printf "%7s %4s %9s %5s\n" $nics ${niclink[0]} $speed $duplex


speed=""
duplex=""
done


Note : Power-1 and UTM-1 There are differences as the nic name changes

Checkpoint : Splat - Disable CD/DVD Rom

How to disable the cd rom from CLI cd /lib/modules/2.6.18-92cp/kernel/drivers/cdrom mv cdrom.ko cdrom.ko.orig Reboot or modprobe -r sr_mod

Cluster XL HA - Going ACTIVE/ACTIVE - BOTH ACTIVE

HA Cluster XL - Going ACTIVE/ACTIVE=============
Model : Power-1/UTM-1/Secure Platform
Things need to be checked to make the pairs identical and to avoid Active / Active stituation and an outage
1. Check Cable of Sync - it should be either cross cable (I have seen the use of a convertor in straight cable to make the cable cross, this can be used) or straight cable thru a dedicated switch/Vlan - THIS IS MOST important
2. Check the cluster XL method - broadcast /multicast , it should be same in both the members
Verify :
[Expert@gehfgmuswaudc31]# cat $FWDIR/boot/ha_boot.conf ha_installed 1 ccp_mode broadcast [Expert@gehfgmuswaudc31]#
in above example it is broadcast mode, even the default is multicast, in cisco gear I found issues with multicast having a low priority and packet dropped eventually in busy networks.
To make it broadcast mode "cphaconf set_ccp broadcast" To make it multicast mode "cphaconf set_ccp multicast"
You will find error logs in tracker when interface is flapping, you must set the mode to broadcast
3. check the values in $FWDIR/boot/modules/fwkern.conf, this value should be same in all members
verify :
[Expert@gehfgmuswaudc31]# cat /opt/CPsuite-R70/fw1/boot/modules/fwkern.conf fwha_mac_magic=0x1f fwha_mac_forward_magic=0x20
5. Disable all interfaces which are not used
you can either disable in webui or use the CLI command as follows
ifconfig down ifconfig --save
You may require reboot after this
I have observed that some case, need to explicitly tell clusterXL about the unused interafces - sk30060 - I never used it, always diabled interfaces
ie , declare the interface which are not used in the below file cpstop
$FWDIR/conf/discntd.if
cpstart
to get the interface name, use command : fw getifs
6. Check CoreXL disabled or enabled in all boxes - coreXL can be enabled in boxes with have min 4 core or more. Licenses should be there for those many cores
- So better disable it if not used in all boxes
7. If the above steps do not resolve the reported behavior, then open ticket with CP with following info
A) make sure the cluster is enabled on both members
B) make sure the problem is replicated
C) collect at the same time CPinfo file from both members
D) collect at the same time CPinfo file from MGMT server
E) run the following debug on both members for 5 minutes
# fw ctl debug 0 # fw ctl debug -buf 32000 # fw ctl debug -m cluster + conf if pnote stat # fw ctl kdebug -T -f 1>> /var/log/debug.txt 2>> /var/log/debug.txt let the debug run for 5 minutes press CTRL+C # fw ctl debug 0
Collect /var/log/debug.txt from each member

Checkpoint - Smart View Monitor - Cashed Info

Sometimes SmartView Monitor gets confused and it displaying wrong (cached) information.

To clear this up you do the following:

- issue cpstop on the Security Management server
- delete $FWDIR/conf/applications.C,
$FWDIR/conf/applications.C.backup,
$FWDIR/conf/CPMILinksMgr.db
and $FWDIR/conf/CPMILinksMgr.db.private
- issue cpstart
- install policy again
- open SmartView Monitor again

Checkpoint : Mount USB Memory Stick / Pen Drive to Splat

Ever wanted to use an USB stick on OpenServer using SPLAT or an appliance?

Just connect the device to an USB port of your choice.

1. Load the appropriate kernel module for handling the USB device
modprobe usb-storage

2. Check which new device was bound, for example /dev/sda1
fdisk -l

3. Create a mount point
mkdir /mnt/usbdisk

4. Mount USB device
mount /dev/sdb1 /mnt/usbdisk

5. Use the device to transfer data as you like

6. Unmount USB device
umount /mnt/usbdisk

How to exclude or include files in the SecurePlatform Backup utility

You can see all the backup schemes in the /var/CPbackup/schemes directory on the SecurePlatform machine. The following schemes are listed: Scheme Name Description cvpn.cpbak Connectra module dtps.cpbak Desktop Policy server (SecureClient) fg1.cpbak Floodgate fw1.cpbak Firewall fw1logs.cpbak Firewall logs gated.cpbak gated ppak.cpbak Performance Pack rt.cpbak Eventia Reporter rtm.cpbak SmartView Monitor snapshot.cpbak Snapshot utility svn.cpbak CPDIR system_configuration.cpbak System configuration uag.cpbak User authentication To include files in the SecurePlatform Backup utility: Access one of the desired schemes (e.g. fw1.cpbak) via a text editor. Search for the line . Add the desired files. Please note that the path must be specified between the tags and . To exclude files in the SecurePlatform Backup utility: Access one of the desired schemes (e.g. fw1.cpbak) via a text editor. Search for the line . Specify the files that you do not want to backup. Please note that the path must be specified between the tags and . Note: You can use "*" to include all files in a specific directory, for example, /var/opt/CPsuite-R65/fw1/conf/*.

Checkpoint - SNMP Monitoring - OID

When you have configured SNMP and Check Point SNMP Extensions on your systems, you can start with system monitoring.

For Nagios we have some plugins available and other vendors also have pre-installed checks for Check Point equipment build into their products.

If you don’t want to use extra plugins you may use the check_snmp plugin command that is delivered with Nagios.

SVN Status
/usr/lib/nagios/plugins/check_snmp -H $HOSTADDRESS$ -C $ARG1" -o 1.3.6.1.4.1.2620.1.6.102.0 -s "\"OK\"" -l "SVN Status"

Security Gateway Policy Status
/usr/lib/nagios/plugins/check_snmp -H $HOSTADDRESS$ -C $ARG1$ -o 1.3.6.1.4.1.2620.1.1.1.0 -s "\"Installed\"" -l "Security Gateway Policy Status"

Security Gateway High Availability Status
/usr/lib/nagios/plugins/check_snmp -H $HOSTADDRESS$ -C $ARG1$ -o 1.3.6.1.4.1.2620.1.5.102.0 -s "\"OK\"" -l "Security Gateway High Availability Status"

Security Gateway High Availability Modus
/usr/lib/nagios/plugins/check_snmp -H $HOSTADDRESS$ -C $ARG1$ -o 1.3.6.1.4.1.2620.1.5.6.0 -s "\"active\"" -l "Security Gateway High Availability Modus"

Security Gateway High Availability Modus
/usr/lib/nagios/plugins/check_snmp -H $HOSTADDRESS$ -C $ARG1$ -o 1.3.6.1.4.1.2620.1.5.6.0 -s "\"passive\"" -l "Security Gateway High Availability Modus"

Security Management Status
/usr/lib/nagios/plugins/check_snmp -H $HOSTADDRESS$ -C $ARG1$ -o 1.3.6.1.4.1.2620.1.7.102.0 -s "\"OK\"" -l "Security Management Status"

Security Management Modus
/usr/lib/nagios/plugins/check_snmp -H $HOSTADDRESS$ -C $ARG1$ -o 1.3.6.1.4.1.2620.1.7.5.0 -s "\"active\"" -l "Security Management Modus"

If your monitoring system is using just simple SNMP queries, here are some OIDs to check for.

SVN Status – to be checked on every system

snmpget.exe -v 2c -c public 10.10.10.10 1.3.6.1.4.1.2620.1.6.102.0
SNMPv2-SMI::enterprises.2620.1.6.102.0 = STRING: "OK"
SNMPv2-SMI::enterprises.2620.1.6.102.0 = STRING: "Problem"

Security Gateway Policy Status

snmpget.exe -v 2c -c public 10.10.10.10 1.3.6.1.4.1.2620.1.1.1.0
SNMPv2-SMI::enterprises.2620.1.1.1.0 = STRING: "Installed"

Security Gateway HA Status

snmpget.exe -v 2c -c public 10.10.10.10 1.3.6.1.4.1.2620.1.5.102.0
SNMPv2-SMI::enterprises.2620.1.5.102.0 = STRING: "OK"

Security Gateway High Availability Mode

snmpget.exe -v 2c -c public 10.10.10.10 1.3.6.1.4.1.2620.1.5.6.0
SNMPv2-SMI::enterprises.2620.1.5.6.0 = STRING: "active"
SNMPv2-SMI::enterprises.2620.1.5.6.0 = STRING: "standby"

Security Management Status

snmpget.exe -v 2c -c public 10.10.10.10 1.3.6.1.4.1.2620.1.7.102.0
SNMPv2-SMI::enterprises.2620.1.7.102.0 = STRING: "OK"
SNMPv2-SMI::enterprises.2620.1.7.102.0 = STRING: "Problem"

Security Management Mode

snmpget.exe -v 2c -c public 10.10.10.10 1.3.6.1.4.1.2620.1.7.5.0
SNMPv2-SMI::enterprises.2620.1.7.5.0 = STRING: "active"

Tobias Lachmann

Checkpoint : Finding memory Leak

A memory leak, technically, is an ever-increasing usage of memory by an application.

With common desktop applications, this may go unnoticed, because a process typically frees any memory it has used when you close the application.

However, In the client/server model, memory leakage is a serious issue, because applications are expected to be available 24×7. Applications must not continue to increase their memory usage indefinitely, because this can cause serious issues. To monitor such memory leaks, we can use the following commands.
[Expert@splat]# ps -aux | sort -k5 -n | tail -5
Warning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.7/FAQ
root 30912 0.0 2.6 213348 55644 ? Sl 2011 0:07 in.aclientd 259
root 3783 0.0 2.6 213352 55544 ? Sl 2011 0:08 in.asessiond 0
root 30659 0.0 2.6 213436 55768 ? Sl 2011 0:08 in.ahclientd 900
root 3784 0.0 2.7 214356 56572 ? Sl 2011 0:09 in.aufpd 0
root 3504 0.0 3.1 414212 65168 ? Ssl 2011 24:32 fwd

In the above ps command, –sort option outputs the highest %MEM at bottom. Just note down the PID for the highest %MEM usage. Then use ps command to view all the details about this process id, and monitor the change over time. You had to manually repeat ir or put it as a cron to a file.

[Expert@splat1]# ps -ev 3504
Warning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.7/FAQ
PID TTY STAT TIME MAJFL TRS DRS RSS %MEM COMMAND
3504 ? Ssl 24:32 22 78 414133 65168 3.1 fwd PPKDIR=/opt/CPppak-R70 CPMDIR=/opt/CPsuite-R70/fw1 CONSOLE=/dev/console TERM=linux SUDIR=/opt/C

[Expert@splat1]# ps -ev 3504
Warning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.7/FAQ
PID TTY STAT TIME MAJFL TRS DRS RSS %MEM COMMAND
3504 ? Ssl 24:32 22 78 414133 65168 3.1 fwd PPKDIR=/opt/CPppak-R70 CPMDIR=/opt/CPsuite-R70/fw1 CONSOLE=/dev/console TERM=linux SUDIR=/opt/C

Note: In the above output, if RSS (resident set size, in KB) increases over time (so would %MEM), it may indicate a memory leak in the application.

Checkpoint : State Syncronization Guide

To reduce or eliminate these error messages verify that you followed the below recomendations:

• Sync network needs to be dedicated to synchronization only. It is not recommended to run VRRP or IPSO Cluster on sync interfaces (refer to sk39179).
• Sync interfaces should be configured as a non-ADP interfaces.
• Synchronization interfaces should be the same speed or faster than the fastest interface on the VRRP or IPSO Cluster. However, this recommendation is impractical when 10 gigabit interfaces are employed. In practice, no more than 2 gigabits of throughput is needed for sync traffic on IPSO Appliances. This means a pair of non-ADP gigabit Ethernet interfaces will be sufficient, though in many cases a single gigabit Ethernet interface will suffice.
• It is recommended to use a dedicated VLAN on a switch, for Check Point sync traffic from a single cluster only i.e. you should not mix CP sync traffic from other cluster members across this dedicated VLAN. Use of cross-over cable is also supported in a 2-node cluster. Choosing to use a switch or a cross-over cable for CP Sync traffic is a environment preference.
• For VRRP only - disable synchronization for certain services. This will help stabilize the systems because:
1. Less memory will be demanded by the sync process. You already saw some related messages in the fwd.elg about sync buffers being full.
2. This will release the CPU time.

The HTTP, HTTPS and DNS services are good candidates to be taken out of synchronization. Because of their nature, they are not affected on a fail over scenario without synchronization.

• The following limitations are applicable for state synchronization over wide area network:
1. The synchronization network must guarantee no more than 100ms latency and no more than 5% packet loss.
2. The synchronization network may only include switches and hubs. No routers are allowed on the synchronization network, because routers will drop Cluster Control Protocol (CCP) packets . CCP is either Multicast or Broadcast and thus non-routable.
• If IP cluster is configured between two IPSO Appliances located in two different cities, CCP and VRRP advertisements need to be update quite frequently. Any latency can cause both cluster members to behave abnormally. Also, if there is a break in the WAN link, both will become master, which can also cause problems.
  The solution is to ensure minimal latency between the cluster members and a highly reliable link.

Checkpoint - IPSO - Memory Usage

In Voyager Monitor option select CPU and Memory Utilization . This gives you the Total Real Memory, Active Real Memory and the Free Memory available on the appliance.

For console access use clish to display the Real Memory Used. This value is displayed in terms of percentage value.

ipso[admin]# clish

clish:1> show useful-stats



Components Total

Active Routes 4

Packets Forwarded 0

VRRP Masters 0

Real Memory Used 22%

Disk Capacity 11%

Note: The real physical memory output gathered from Voyager is taken from the kernel directly.

Checkpoint : SecureXL

When SecureXL is enabled, all traffic should be accelerated, except traffic that matches the following conditions:

• The first packets of any new TCP session, unless a "template" exists.
• The first packet of any new UDP session.
• All traffic that matches a service that uses a Resource.
• Certain traffic that matches a service that is inspected by a SmartDefence or Web Intelligence feature. For example, traffic on which SSH protections are activated is not accelerated. For more details, refer to sk42401: Factors that adversely affect performance in SecureXL.
• All traffic that is supposed to be dropped or rejected, according to the rule base.
• All traffic that matches a rule, whose source or destination is the Gateway itself.
• All traffic that matches a rule with a Security Server.
• All traffic that matches a rule with User Authentication or Session Authentication.
• Non-TCP/UDP/GRE/ESP traffic.
• All multicast traffic.
• All fragmented traffic.
• All traffic with IP options.
• RST packets, when the "Spoofed Reset Protection" feature is activated.
• When using ClusterXL in Load Sharing mode with 'Sticky Decision Function'.
• Traffic that violates stateful inspection paradigm, or that is suspected to be spoofed.
• IPv6 traffic

Connection establishment acceleration ("templates" mechanism)

In order to enhance connection establishment acceleration, a mechanism attempts to "group together" all connections that match a particular service and whose sole discriminating element is the Source Port. This type of "grouping" enables even the very first packets of a TCP handshake to be accelerated. This is very useful on short connections, in which the percentage of TCP handshake traffic is very high.

The very first packets of the first connection on the same service will be forwarded to the Security Gateway's kernel, which will then create a "template" of the connection and notify the SecureXL device. Any subsequent TCP establishments on the same service (where only the source port is different) will already be accelerated (as well as any other traffic, of course).

There are several conditions that will prevent a template from being created:

• Connections that cannot be discriminated ONLY by the source port cannot be templated.
• NATed traffic cannot be templated.
• VPN traffic cannot be templated.
• Complex connections (FTP, H323, etc.) cannot be templated.
• Non-TCP/Non-UDP traffic cannot be templated.
• The following rules will prevent a Connection Template from being created. All subsequent rules below such rules will not be templated as well, regardless of the rule. It is advised that all rules that can be templated, be placed at the top of the rule base (unless of course, this will violate other optimization considerations):
  
  • Rule with service 'Any'
  • Rule with a service that has a 'handler' (where a specific protocol is chosen in 'Protocol Type' field - instead of 'None' ; go to service object - right-click - Edit... - Advanced... - Protocol Type:).
  • Rules with the following objects:
    
    • Time object
    • Port range object
    • Dynamic object
  • Rules with "complex" services (i.e., services that have anything specified in the "Match" field, or "Enable reply from any port" of their "Advanced" section or Source Port is defined).
  • Rules with RPC/DCOM/DCE-RPC services.
  • Rules with Client Authentication or Session Authentication.
  • When SYN Defender or Small PMTU features are activated in SmartDefense/IPS

Checkpoint : Memory

hmem

failures mean that the hmem is full. This is not a real memory problem, but indicates a configuration problem. If low hmem limit was configured, it leads to improper usage of the OS memory.

Possible reasons for

smem failures are: smem reached its limit, exhausted the OS memory or large non-sleep allocations. This can indicate some memory shortage.

kmem

failed allocations means that some applications did not get memory. his is usually an indication for a memory problem. The most common memory problem is memory shortage. Memory shortage sometimes indicates a memory leak. In order to troubleshoot memory shortage, stop the load and let connections close.

In case memory consumption went back to normal, you are not dealing with a memory leak. Such shortage might happen when traffic volumes are too high for the device capacity. If the memory shortage happens after a change in the system or the environment, undo the change, and check whether kmem memory consumption goes down.

Checkpoint - SecureXL

When SecureXL is enabled, all traffic that matches following conditions will not be accelerated:

* The first packets of any new TCP session, unless a "template" exists.
* The first packet of any new UDP session.
* All traffic that matches a service that uses a resource.
* All traffic that matches a service that is inspected by a SmartDefence or Web Intelligence feature.
* All traffic that is supposed to be dropped or rejected, according to the rule base.
* All traffic that matches a rule, whose source or destination is the gateway itself.
* All traffic that matches a rule with a security server.
* All traffic that matches a rule with user authentication or session authentication.
* Non-TCP/UDP/GRE/ESP trafic (e.g. ICMP, IGRP, etc.)
* All multicast traffic. **** Prior to IPSO-3.9. In IPSO-3.9 has support for Multicast PIM acceleration for IP225x. IPSO-4.2 supports Multicast PIM acceleration for all Nokia Platforms.
* All fragmented traffic.
* All traffic with IP options.
* RST packets, when the "Spoofed Reset Protection" feature is activated.
* Traffic that violates stateful inspection paradigm or that is suspected to be spoofed.
* Rules where the service has an INSPECT handler (e.g. FTP control connection)
* Rules with action "encrypt" with no VPN H/W Accelerator card.
* All VoIP traffic
* All VPN traffic with IP Compression enabled.
* All directed broadcast traff

Connection establishment acceleration ("templates" mechanism)

In order to enhance connection establishment acceleration, a mechanism attempts to "group together" all connections that match a particular service and whose sole discriminating element is the source port. This type of "grouping" enables even the very first packets of a TCP handshake to be accelerated. This is very useful on short connections, in which the percentage of TCP handshake traffic is very high.

The very first packets of the first connection on the same service will be forwarded to the security gateway, which will then create a "template" of the connection and notify the SecureXL device. Any subsequent TCP establishments on the same service (where only the source port is different) will already be accelerated (as well as any other traffic, of course).

Conditions that will prevent a template from being created:

* All connections that cannot be discriminated ONLY by the source port.
* Traffic subject to NAT.
* VPN traffic.
* Non-trivial TCP/UDP connections (FTP, H323, etc.).
* Non-TCP/UDP traffic.

Checkpoint : SNMP Support : cpsnmpd

urrently, cpsnmpd only support SNMP version 1. As shown in last line of /var/etc/snmpd.conf.

proxy -v 1 -p 260 -c public localhost .1.3.6.1.4.1.2620

Check Point snmp daemon (cpsnmpd) process is binded to port 260 (as opposed to the default port 161). cpsnmpd can be enabled via cpconfig [select 'SNMP Extensions'] or $FWDIR/bin/cpsnmpd -p 260 command. Since IPSO 3.1, IPSO is able to act as proxy to poll Checkpoint MIBs. I.e, user can poll Checkpoint MIB via port 161.

The following shows the output of snmp polling on port 260 using snmp version 1 & 2c. 'public' was used as snmp community name.

SNMP polling was successfully when SNMP version 1 was used

[root@linux root]# snmpwalk -v 1 -c public 10.58.18.70:260 -On .1.3.6.1.4.1.2620.1.1.25.1.0

.1.3.6.1.4.1.2620.1.1.25.1.0 = STRING: "Standard"

[root@linux root]#

SNMP polling failed when SNMP version 2c was used

[root@linux root]# snmpwalk -v 2c -c public 10.58.18.70:260 -On .1.3.6.1.4.1.2620.1.1.25.1.0

Timeout: No Response from 10.58.18.70:260

[root@linux root]#

SNMP polling using v2c without port 260 was successful

[root@linux root]# snmpwalk -v 2c -c public 10.58.18.70 .1.3.6.1.4.1.2620.1.1.25.1.0

SNMPv2-SMI::enterprises.2620.1.1.25.1.0 = STRING: "Standard"

[root@linux root]#

Monitoring Checkpoint Firewalls with SNMP

I've been doing some work for a client with Checkpoint Firewalls (running Secure Platform, or SPLAT), and wanted to monitor them using SNMP. The two main reasons being;

1. To graph Accepted/Dropped/Rejected packets over time and

2. To Poll the Firewalls for status using 3rd Party Management Tools like "Whats Up Gold" and "BMC Patrol".

So a brief summary of what I had to do to get it to work correctly:

1. Enable SNMPD

chkconfig snmpd on

service snmpd start

2. Edit /etc/snmp/snmpd.conf
Add "rocommunity NotPublicCommunityString 192.168.0.1"

Add "proxy -v1 -c public 127.0.0.1:260 .1.3.6.1.4.1.2620"

3. Edit $FWDIR/conf/snmp.C

Add :snmp_community (
:read (“public”)
:write(“private”)
)

4. Run cpconfig, and enable the cpsnmpd extension

5. Add required security rule to permit access to the firewall from the management server(s) (SNMP-UDP/161) (You don't need to permit access to cpsnmpd-UDP/260)

Following these changes you should be able to do a 'netstat -an' and see the cpsnmpd listening on :260, and perform a local snmp check:

snmpwalk -v1 -c public localhost 1.3.6.1.4.1.2620.1.6

Gotchas to note:

1. The local snmpwalk above uses the "public" string - the one in snmp.C - NOT the one in snmpd.conf

2. snmpwalk from a remote host uses the "NotPublicCommunityString" - not "public"

3. snmpwalk locally (and maybe remotely) using just the OID 1.3.6.1.4.1.2620 causes the cpsnmpd process to die (need to restart it using '$CPDIR/bin/cpsnmpd -p 260' or cpstop, cpstart)

Once the above are done the management servers can query the enforcement module for Checkpoint SNMP OIDs, such as accepted packets, dropped packets and Checkpoint OS OIDs like CPU usage (accurate), memory usage etc. These queries go to the Firewall on UDP/161 and internally the snmpd process proxies the snmp request for OID .1.3.6.1.4.1.2620 (checkpoint) to the cpsnmpd process on UDP/260.

This happens by default in Nokia IPSO, but not on SecurePlatform.

Some good OIDs to Graph:

Active Real Memory .1.3.6.1.4.1.2620.1.6.7.4.4.0
Total Real Memory .1.3.6.1.4.1.2620.1.6.7.4.3.0
Packets accepted .1.3.6.1.4.1.2620.1.1.4.0
Packets dropped .1.3.6.1.4.1.2620.1.1.6.0
Packets rejected .1.3.6.1.4.1.2620.1.1.5.0
Packets logged .1.3.6.1.4.1.2620.1.1.7.0
Current connections .1.3.6.1.4.1.2620.1.1.25.3.0
Processor (System) .1.3.6.1.4.1.2620.1.6.7.2.2.0
Processor (User) .1.3.6.1.4.1.2620.1.6.7.2.1.0

And good OIDs to monitor for status:
Firewall Module State (Installed) .1.3.6.1.4.1.2620.1.1.1.0
Processor Usage .1.3.6.1.4.1.2620.1.6.7.2.4.0

Useful Links:

Cacti - An excellent (+free) web front end to MRTG/RRD-Tool

Cacti Templates Index - Although the supplied Checkpoint/Nokia ones didnt work for me without customisation. I created some more graphs and data sources using the above OIDs.

What's Up Gold - The new version is very nice. Excellent Web based multi-user UI.

SNMP - Firewall Current Policy

What if you dont have access to a firewall and you want to know the firewall policy (I am not considering the option of taking somebody's password and log in ;-) or even to ask someone to check and let me know...)

So if snmp is enabled in you device and checkpoint (cpsnmpd), it is possible



snmpwalk 1.3.6.1.4.1.2620.1.1.2

Syntax : snmpwalk

Security Servers - daemon names and definitions

Security Servers and processes are grouped by function

1. Content and traffic management :
   
   
   • in.aftpd - FTP Security Server
   
   
   • in.ahttpd - HTTP Security Server
   
   
   • in.arlogind - rlogin Security Server
   
   
   • in.atelnetd - Telnet Security Server
   
   
   • in.asmtpd - SMTP Security Server (used to receive SMTP messages)
   • mdq - Mail DeQueuer daemon (delivers mail messages queued by in.asmtpd)
   
   
   • in.emaild.mta - E-Mail Security Server (Ant-Virus scanning of e-mails)
   • in.emaild.pop3 - POP3 Security Server (Ant-Virus scanning of e-mails)
   • in.emaild.smtp - SMTP Security Server (Ant-Virus scanning of e-mails)
   
   
   • in.aufpd - URL Filtering Protocol (UFP) daemon (communicates with UFP server)
   • in.ufclnt - URL Filtering Protocol Client (starting in R71 - part of URL Filtering engine in kernel)
   • in.ufsrvr - URL Filtering Protocol Server (starting in R71 - part of URL Filtering engine in kernel)
   
   
   • stormd - SmartDefense Storm Center Module
   
   
   • in.genericd - the TCP 'genericd' resource invokes a daemon, which is not a Security Server, but rather the mediator between the client, the CVP Server and the destination server
   
   
   
2. Authentication and load balancing :
   
   
   • in.asessiond - Session Authentication Security Server Agent
   
   
   • in.aclientd - Client Authentication process (port 259)
   
   
   • in.ahclientd - Client Authentication via Web (port 900). Executable starts when user initiates client authentication through a Web browser
   
   
   • in.lhttpd - Load Balancing daemon is the user mode process that handles HTTP requests, when the load balancing method is set to HTTP - listens for and redirects HTTP requests coming for load balancing
   
   
   • in.pingd - Load balancing or/and Client Authentication in Wait mode
   
   
   
3. VPN :
   
   
   • vpnd - VPN daemon
   
   
   • xrmd - Extranet Manager Process. If Gateway Module is defined as Extranet Enabled Gateway, public key can be shared with this process
   
   
   • sdsd - Software Distribution Server. Distributes software to SecureClient users
   
   
   • dtpsd - Desktop Policy Server. SecureClient users fetch policy from this
   
   
   • dtlsd - Desktop Log Server. Receives logs from SecureClient users
   
   
   • in.ahttpsd -Clientless VPN daemon

Checkpoint : Rules from Gateway

sed "/:rules-adtr/,/^$/d" rules.C | egrep ": |:action|:disabled|:global_

location|:through|:time|:track|:dst|:install|:services|:src" | more

http://www.networksandsecurity.com/home/2009/08/24/recovering-from-a-dead-check-point-smartcenter/