Reason for Firewall Drop : fw ctl zdebug drop

One of my favorite troubleshooting command is "fw ctl zdebug drop"

This will show the realtime logs.. No need of worrying where is my Tracker for a real time log..

The output is very nice, shows the reason for the drop and can easily be filtered with the grep command for IP addresses:

fw_log_drop: Packet proto=17 10.255.253.21:20031 -> 10.255.253.255:20031 dropped by fw_antispoof_log Reason: Address spoofing

fw_log_drop: Packet proto=17 192.243.100.205:58999 -> 224.0.0.1:9996 dropped by fw_handle_first_packet Reason: Rulebase drop - rule 243

fw_log_drop: Packet proto=1 10.68.111.2:1281 -> 10.68.111.5:1669 dropped by fw_icmp_stateless_checks Reason: ICMP redirect packets are not allowed

fw_log_drop: Packet proto=6 192.243.119.238:80 -> 91.96.46.174:49543 dropped by fw_first_packet_state_checks Reason: First packet isn't SYN

Since this is realtime debug output, you need to have live traffic through the firewall to see if a packet is dropped. When you try to investigate the reason for a drop of an older connection, you have to go the SmartView Tracker.

One more example....
[Expert@FW-1]# fw ctl zdebug drop | grep 3.212.227.23
;[cpu_2];[fw_1];fw_log_drop: Packet proto=6 3.212.227.23:51459 -> 3.245.237.213:443 dropped by fw_handle_first_packet Reason: Rulebase drop - rule 38;
;[cpu_2];[fw_1];fw_log_drop: Packet proto=6 3.212.227.23:51459 -> 3.245.237.213:443 dropped by fw_handle_first_packet Reason: Rulebase drop - rule 38;
;[cpu_2];[fw_1];fw_log_drop: Packet proto=6 3.212.227.23:51459 -> 3.245.237.213:443 dropped by fw_handle_first_packet Reason: Rulebase drop - rule 38;


=======================================================

To check why traffic is being silently dropped by a firewall, simultaneously run the following:

1. FW MONITOR to gather all traffic between Host A and Host B. The syntax would be:

fw monitor -e "accept src=n.n.n.n or dst=x.x.x.x or src=y.y.y.y or dst=y.y.y.y;" -o fwmon.cap &

where n.n.n.n is the IP address of Host A, and y.y.y.y is the IP address of Host B. The '&' sign will put fw monitor in the background.

2. Start the kernel debugging for drop activities:

fw ctl zdebug drop > fwctl.txt

Now replicate the problem to gather the debugs.

When finished, press Ctrl+C to break the 'fw ctl zdebug' command and then type 'fg' to bring back the 'fw monitor' to the foreground.

Enter Ctrl+C again to cancel the fw monitor.

Analyse the output files fwmon.cap and fwctl.txt to determine what is being dropped and why it is being dropped

============================================================

Checkpoint Ports

TCP Port 256 is used for three important things:

Exchange of CA and DH keys in FWZ and SKIP encryption between two FireWall-1 Management Consoles SecuRemote build 4005 and earlier uses this port to fetch the network topology and encryption keys from a FireWall-1 Management Console
When instaling a policy, the management console uses this port to push the policy to the remote firewall.

TCP Port 257 (FW1_log) is used for logging purposes.

TCP Port 258 is used by the fwpolicy remote GUI. FireWall-1 will only listen to this port on a management console.

TCP Port 259 is used for Client Authentication via telnet. FireWall-1 will only listen to this port on a firewall module.

UDP Port 259 is used in FWZ encryption to manage the encrypted session (SecuRemote and FireWall-1 to FireWall-1 VPNs).

UDP Port 260 and UDP Port 161 are used for the SNMP daemon that Check Point FireWall-1 Provides.

TCP Port 262 is used by netsod, which is the Single Sign-on Daemon. This can be disabled by commenting out the line that contains netsod in $FWDIR/conf/fwauthd.conf.

TCP Port 264 is used for Secure Client (SecuRemote) build 4100 and later to fetch network topology and encryption keys from a FireWall-1 Management Console. FireWall-1 will only listen to this port on a management console.

UDP Port 500 is used for ISAKMP key exchange between firewalls or between a firewall and a host running Secure Client. FireWall-1 will only listen to this port on a firewall module.

TCP Port 900 is used by FireWall-1's HTTP Client Authentication mechanism. This can be disabled by commenting the appropriate line in $FWDIR/bin/fwauthd.conf.

TCP Port 4532 is used for the Session Auth agent, asessiond.TCP Ports above 1024, other than the ones listed below, are generally any Security Servers that are active. The actual ports used by these servers will vary. 1024 is the lowest & 65535 is the highest port a Security Server process will use for a connection. If you wish to minimize the number of ports listening, comment out the appropriate lines from $FWDIR/conf/fwauthd.conf. Note that if you disable a security server in this fashion, you can not use its capabilities (like content security or authentication), so make sure you only do it for the security servers you know you are not using.

TCP Port 18181 is used for CVP (Content Vectoring Protocol, for anti-virus scanning). FireWall-1 will not listen on this port.TCP Port 18182 is used for UFP (URL Filtering Protocol, for WebSense and the like). FireWall-1 will not listen on this port.

TCP Port 18183 is used for SAM (Suspicious Activity Monitoring, for intrusion detection). If you do not use these features, you can comment out the appropriate lines in $FWDIR/conf/fwopsec.conf.

TCP Port 18184 is used for Log Export API (lea). If you do not use these features, you can comment out the appropriate lines in $FWDIR/conf/fwopsec.conf.

TCP Port 18186 (FW1_omi-sic) is used for Secure Internal Communications (SIC) between OPSEC certified products and a NG FireWall module.

TCP Port 18190 (CPMI) is used by the FireWall Management process (FWM) to listen for NG Management Clients attempting to connect to the management module.

TCP Port 18191 (CPD) is used by the CPD process for communications such as policy installation, certificate revocation, and status queries.

TCP Port 18192 (CPD_amon) is used by the CPD process FireWall Application Monitoring.

TCP Port 18196 is used for CPEPS which is part of User Monitor.

TCP Port 18207 is used by polsrvd, which is the Single Sign-on Daemon. This can be disabled by commenting out the line that contains polsrvd in $FWDIR/conf/fwauthd.conf.

TCP Port 18210 (FW1_ica_pull): The CPD process, on the management module, is listening on
TCP port 18210 for certificates to be "pulled" by a FireWall module from a management module.

TCP Port 18211 (FW1_ica_push): The Check Point Daemon (CPD) process, running on the FireWall module, listens on TCP port 18211 for certificate creation and for the "push" of the certificate to the FireWall module from the management module.

Should you make any changes above, the 'fwd' process will need to be restarted as follows:

nokia[admin]# fw kill fwdnokia

[admin]# fwd `cat $FWDIR/conf/masters`

Memory & CPU in Linux

cat /proc/meminfo
cat /proc/cpuinfo

"free -m" is always a good option

Checkpoint : Nokia Hardware - Model - Serial Number

FW [Admin]# cat /var/etc/.nvram
Vendor Nokia
Chassis serialnum: 93064000318
Model IP560
FW [Admin]#

TCP DUMP - Deep Inside

Running the tcpdump utility
====================

Following are examples of commands used to run the tcpdump utility:
Selecting an Interface or VLAN

The tcpdump utility is able to sniff for packets on only one interface or VLAN. By default, it will select the lowest numbered interface.

To select an interface, use the -i flag as follows:

tcpdump -i

For example:
tcpdump -i exp1
tcpdump -i 1.10
tcpdump -i internal

Disabling name resolution

By default, tcpdump will attempt to look up IP addresses and use names, rather than numbers, in the output. BIG-IP must wait for a response from the DNS server, so the lookups can be time consuming and the output may be confusing.

To disable name resolution, use the -n flag as in the following examples:

tcpdump -n
tcpdump -ni internal

Saving tcpdump output to a file

You can save the tcpdump data to one of the following file formats:

• A binary file that contains all the information collected by the tcpdump and is readable by the tcpdump utility as well as many other traffic analysis packages.
• A text file that contains a subset of the full tcpdump data, but is readable only as plain text.
Binary file

To save the tcpdump output to a binary file, type the following command:

tcpdump -w

For example:

tcpdump -w dump1.bin

Note: The tcpdump utility will not print data to the screen while it is capturing to a file. To stop the capture, press CTRL-C.

Text file

To save the tcpdump output to a text file, type the following command:

tcpdump >

For example:

tcpdump >dump1.txt

Reading tcpdump binary file output

To read data from a binary tcpdump file (that you saved by using the tcpdump -w command), type the following command:

tcpdump -r

For example:

tcpdump -r dump1.bin

In this mode, the tcpdump utility reads stored packets from the file, but otherwise operates just as it would reading from the network interface. As a result, you can use formatting commands and filters.

Filters

The tcpdump utility allows you to use filters to, among other things, restrict the output to specified addresses and ports and specified tcp flags.

Filtering on a host address

• To view all packets that are traveling to or from a specific IP address, type the following command:

tcpdump host

For example:

tcpdump host 10.90.100.1

• To view all packets that are traveling from a specific IP address, type the following command:
tcpdump src host

For example:

tcpdump src host 10.90.100.1

• To view all packets that are traveling to a particular IP address, type the following command:
tcpdump dst host

For example:

tcpdump dst host 10.90.100.1

Filtering on a port

• To view all packets that are traveling through the BIG-IP system and are either sourced from or destined to a specific port, type the following command:

tcpdump port

For example:

tcpdump port 80

• To view all packets that are traveling through the BIG-IP system and sourced from a specific port, type the following command:

tcpdump src port

For example:

tcpdump src port 80

• To view all packets that are traveling through the BIG-IP system and destined to a specific port, type the following command:

tcpdump dst port

For example:

tcpdump dst port 80

Filtering on a tcp flag

• To view all packets that are traveling through the BIG-IP system that contain the SYN flag, type the following command:
tcpdump 'tcp[tcpflags] & (tcp-syn) != 0'

• To view all packets that are traveling through the BIG-IP system that contain the RST flag, type the following command:
tcpdump 'tcp[tcpflags] & (tcp-rst) != 0'
Combining filters with the and operator

You can use the and operator to filter for a mixture of output.

Following are some examples of useful combinations:

tcpdump host 10.90.100.1 and port 80
tcpdump src host 172.16.101.20 and dst port 80
tcpdump src host 172.16.101.20 and dst host 10.90.100.1

Capturing Packet Data

The tcpdump utility provides an option which allows you to specify the amount of each packet to capture.

You can use the -s (snarf/snaplen) option to specify the amount of each packet to capture. To capture the entire packet, use a value of 0 (zero). For example:

tcpdump -s0 src host 172.16.101.20 and dst port 80

Alternatively, you can specify a length large enough to capture the packet data you need to examine. For example:

tcpdump -s200 src host 172.16.101.20 and dst port 80

If you are using the tcpdump utility to examine the output on the console during capture or by reading from an input file with the -r option, you should also use the -X flag to display ASCII encoded output along with the default HEX encoded output. For example:

tcpdump -X -s200 src host 172.16.101.20 and dst port 80

Supressing hostname and port resolution

The tcpdump utility provides an option which allows you to specify whether IP addresses and service ports are translated to their corresponding hostnames and service names.
Since performing multiple name lookups during a packet capture may be resource intensive, you should disable name resolution while capturing on a busy system using the -n option. For example:

tcpdump -n src host 172.16.101.20 and dst port 80

Service port lookups incur less overhead than DNS-based name resolutions, but still are usually unnecessary while capturing. You can disable both name and service port resolution while capturing by using the -nn option. For example:

tcpdump -nn src host 172.16.101.20 and dst port 80

Combining tcpdump options

This Solution contains the most essential tcpdump options. You will generally need to use most of the options in combination.

Following are examples of how to combine the tcpdump options to provide the most meaningful output:

tcpdump -ni internal -w dump1.bin
tcpdump -ni internal -r dump1.bin host 10.90.100.1
tcpdump -ni exp1 host 10.90.100.1 and port 80
tcpdump -ni 1.10 src host 172.16.101.20 and dst port 80 >dump1.txt
tcpdump -Xs200 -nni eth0 -w /var/tmp/mgmt.cap dst host 172.16.101.20 and dst port 162

Checkpoint Ports

TCP Port 256 is used for three important things: Exchange of CA and DH keys in FWZ and SKIP encryption between two FireWall-1 Management Consoles SecuRemote build 4005 and earlier uses this port to fetch the network topology and encryption keys from a FireWall-1 Management Console When instaling a policy, the management console uses this port to push the policy to the remote firewall. TCP Port 257 (FW1_log) is used for logging purposes. TCP Port 258 is used by the fwpolicy remote GUI. FireWall-1 will only listen to this port on a management console. TCP Port 259 is used for Client Authentication via telnet. FireWall-1 will only listen to this port on a firewall module. UDP Port 259 is used in FWZ encryption to manage the encrypted session (SecuRemote and FireWall-1 to FireWall-1 VPNs). UDP Port 260 and UDP Port 161 are used for the SNMP daemon that Check Point FireWall-1 Provides. TCP Port 262 is used by netsod, which is the Single Sign-on Daemon. This can be disabled by commenting out the line that contains netsod in $FWDIR/conf/fwauthd.conf. TCP Port 264 is used for Secure Client (SecuRemote) build 4100 and later to fetch network topology and encryption keys from a FireWall-1 Management Console. FireWall-1 will only listen to this port on a management console. UDP Port 500 is used for ISAKMP key exchange between firewalls or between a firewall and a host running Secure Client. FireWall-1 will only listen to this port on a firewall module. TCP Port 900 is used by FireWall-1's HTTP Client Authentication mechanism. This can be disabled by commenting the appropriate line in $FWDIR/bin/fwauthd.conf. TCP Port 4532 is used for the Session Auth agent, asessiond. TCP Ports above 1024, other than the ones listed below, are generally any Security Servers that are active. The actual ports used by these servers will vary. 1024 is the lowest & 65535 is the highest port a Security Server process will use for a connection. If you wish to minimize the number of ports listening, comment out the appropriate lines from $FWDIR/conf/fwauthd.conf. Note that if you disable a security server in this fashion, you can not use its capabilities (like content security or authentication), so make sure you only do it for the security servers you know you are not using. TCP Port 18181 is used for CVP (Content Vectoring Protocol, for anti-virus scanning). FireWall-1 will not listen on this port. TCP Port 18182 is used for UFP (URL Filtering Protocol, for WebSense and the like). FireWall-1 will not listen on this port. TCP Port 18183 is used for SAM (Suspicious Activity Monitoring, for intrusion detection). If you do not use these features, you can comment out the appropriate lines in $FWDIR/conf/fwopsec.conf. TCP Port 18184 is used for Log Export API (lea). If you do not use these features, you can comment out the appropriate lines in $FWDIR/conf/fwopsec.conf. TCP Port 18186 (FW1_omi-sic) is used for Secure Internal Communications (SIC) between OPSEC certified products and a NG FireWall module. TCP Port 18190 (CPMI) is used by the FireWall Management process (FWM) to listen for NG Management Clients attempting to connect to the management module. TCP Port 18191 (CPD) is used by the CPD process for communications such as policy installation, certificate revocation, and status queries. TCP Port 18192 (CPD_amon) is used by the CPD process FireWall Application Monitoring. TCP Port 18196 is used for CPEPS which is part of User Monitor. TCP Port 18207 is used by polsrvd, which is the Single Sign-on Daemon. This can be disabled by commenting out the line that contains polsrvd in $FWDIR/conf/fwauthd.conf. TCP Port 18210 (FW1_ica_pull): The CPD process, on the management module, is listening on TCP port 18210 for certificates to be "pulled" by a FireWall module from a management module. TCP Port 18211 (FW1_ica_push): The Check Point Daemon (CPD) process, running on the FireWall module, listens on TCP port 18211 for certificate creation and for the "push" of the certificate to the FireWall module from the management module. Should you make any changes above, the 'fwd' process will need to be restarted as follows: nokia[admin]# fw kill fwd nokia[admin]# fwd `cat $FWDIR/conf/masters`

Forcing NICs on SecurePlatform full/half duplex or 10/100/1000 Mbps using ethtool

In expert mode, use the 'ethtool' to hard code link speed and duplex settings of network interfacesNICs.

Note: Per the IEEE specification, gigabit speed cannot be forced. It can only be auto-negotiated.

Quick command syntax:

ethtool -s DEVNAME speed 10|100|1000 duplex full|half autoneg off|on

Example:

• ethtool -s eth0 speed 100 duplex full autoneg off
  (Will force eth0 interface to 100 MB link speed, full duplex).

• ethtool -s eth0 speed 100 duplex half
  (Will force eth0 interface to 100 MB link speed, half duplex).

• ethtool -s eth0 autoneg on
  (Will force eth0 interface to auto-negotiate).

• ethtool -s eth0 autoneg off
  (Will force eth0 interface auto-negotiate off).

Commands can be put at the end of the /etc/rc.local startup script, to survive reboot.

m Wake on multicast messages.
b Wake on broadcast messages.
a Wake on ARP.
g Wake on MagicPacket(tm).
s Enable SecureOn(tm) password for MagicPacket(tm).
d Disable (wake on nothing). This option clears all previous options.

sopass xx:yy:zz:aa:bb:cc
(Set SecureOn(tm) password. Argument to this option must be 6 bytes in ethernet MAC hex format (xx:yy:zz:aa:bb:cc).

msglvl N
(Set driver message level. Meanings differ per driver).


Full options of command:
Example:

ethtool -s ethX [speed 10|100|1000] [duplex half|full] [port tp|aui|bnc|mii] [autoneg on|off] [phyad N] [xcvr internal|external]
[wol p|u|m|b|a|g|s|d...] [sopass xx:yy:zz:aa:bb:cc] [msglvl N]

OPTIONS

-s
Allows changing some or all settings of the specified Ethernet device; options only apply if -s is specified.

ethX
Device Name

speed 10|100|1000
Sets speed in Mbps; ethtool with a single argument will show supported device speeds.

duplex half|full
Sets full- or half-duplex mode.

port tp|aui|bnc|mii
Selects device port.

autoneg on|off
Specifies whether or not autonegotiation is enabled.

phyad N
Physical address

xcvr internal|external
Selects transceiver type; currently only internal and external can be specified.

wol p|u|m|b|a|g|s|d...
Sets Wake-on-LAN options; not all devices support this. The Argument to this option is a string of characters specifying the options to enable.


p Wake on physically activity.
u Wake on unicast messages.