SNMP - Firewall Current Policy

What if you dont have access to a firewall and you want to know the firewall policy (I am not considering the option of taking somebody's password and log in ;-) or even to ask someone to check and let me know...)

So if snmp is enabled in you device and checkpoint (cpsnmpd), it is possible



snmpwalk 1.3.6.1.4.1.2620.1.1.2

Syntax : snmpwalk

Linux Commands

Access Control

exit - terminate a shell (see "man sh" or "man csh")

logout - sign off; end session (C shell and bash shell only;)

passwd - change login password

rlogin - log in remotely to another UNIX system

ssh - secure shell

slogin - secure version of rlogin

yppasswd - change login password in yellow pages

Communications

mail - send and receive mail

mesg - permit or deny terminal messages and talk requests

pine - send and receive mail

talk - talk to another logged-in user

write - write to another logged-in user

Programming Tools

as - assembler, specific to each machine architecture

awk - pattern scanning and processing language

bc - online calculator

cc - C compiler

csh - C shell command interpreter

dbx - source-level debugging program

f77 - Fortran compiler

gdb - GNU Project debugger

gprof - display profile of called routines

kill - kill a process

ld - the UNIX loader

lex - generate lexical analysis programs

lint - check C source code

make - maintain large programs

maple - symbolic mathematics program

math - symbolic mathematics program

nice - run a command at low priority (see "man nice" or "man csh")

nohup - run a command immune to hangups

pc - Pascal compiler (xlp on ADS)

perl - Popular script interpreter

prof - display profile data

python - Python programming language

sh - Bourne shell command interpreter

yacc - generate input parsing programs

xcalc - graphical calulator under x

y

Documentation

apropos - locate commands by keyword lookup

find - locate file (i.e. find . -name *.tex -print)

info - start the info explorer program

man - find manual information about commands

whatis - describe what a command is

whereis - locate source, binary, or man page for a program

Editors

emacs - screen-oriented text editor

pico - screen-oriented text editor (renamed called nano)

sed - stream-oriented text editor

vi - full-screen text editor

vim - full-screen text editor ("vi-improved")

File and Directory Management

cd - change working directory

chmod - change the protection of a file or directory

chown - change owner (or group) of a file or directory

chgrp - change group of a file or directory

cmp - compare two files

comm - select/reject lines common to two sorted files

cp - copy files

crypt - encrypt/decrypt files (CCWF only)

diff - compare the contents of two ASCII files

file - determine file type

grep - search a file for a pattern

gzip - compress or expand files

ln - make a link to a file

ls - list the contents of a directory

lsof - list of open files

mkdir - create a directory

mv - move or rename files and directories

pwd - show the full pathname of your working directory

quota - display disk usage and limits

rm - delete (remove) files

rmdir - delete (remove) directories

stat - status of file (i.e. last access)

sync - flush filesystem buffers

sort - sort or merge files

tar - create or extract archives

tee - copy input to standard output and other files

tr - translate characters

umask - change default file protections

uncompress - restore compressed file

uniq - report (or delete) repeated lines in a file

wc - count lines, words, and characters in a file

File Display and Printing

cat - show the contents of a file; catenate files

fold - fold long lines to fit output device

head - show first few lines of a file

lpq - examine the printer spooling queue

lpr - print a file

lprm - remove jobs from the printer spooling queue

more - display a file, one screen at a time

less - like more with more features

page - like "more", but prints screens top to bottom

pr - paginate a file for printing

tail - show the last part of a file

zcat - display a compressed file

xv - show print, manipulate images

gv - show ps and pdf files

xpdf = shopw pdf files (use gv)

File Transfer

ftp - transfer files between network hosts

rsync - fast and flexible sync between computers

scp - secure version of rcp

Miscellaneous

alias - define synonym commands

chquota - change disk quota on ACITS UNIX systems

chsh - change default login shell

clear - clear terminal screen

echo - echo arguments

pbm - portable bitmap manipulation programs

popd - pop the directory stack (C shell only)

pushd - push directory on stack (C shell only)

script - make typescript of terminal session

setenv - set an environment variable (C shell only)

stty - set terminal options

News/Networks

netstat - show network status

rsh - run shell or command on another UNIX system

ssh - secure-shell version of rsh

Process Control

bg - put suspended process into background

fg - bring process into foreground

jobs - list processes

^y - suspend process at next input request

^z - suspend current process 

Status Information

clock - determine processor time

date - show date and time

df - summarize free disk space

du - summarize disk space used

env - display environment

finger - look up user information

history - list previously issued commands 

last - indicate last login of users

lpq - examine spool queue

manpath - show search path for man pages

printenv - print out environment

ps - show process status

pwd - print full pathname of working directory

set - set shell variables (C shell, bash, or ksh)

spend - lists year-to-date ACITS UNIX charges

stty - set terminal options

time - timing programs

top - list  top  cpu processes

uptime - show system load, how long system has been up

w - show who is on system, what command each job is executing

who - show who is logged onto the system

whois - Internet user name directory service

whoami - who owns the shell

Image Processing

gimp - photoshop type image processing program

xfig - drawing program

xv - image viewer

xvscan - scan picture 

xpaint - paint program

kpaint - kde paint program 

Sound

mplayer - mpg player 

realplay - realaudio player

timidity - midi to wav converter and player

xmms - mp3 player 

Text Processing

abiword - open source word processor

addbib - create or extend bibliographic database

col - filter reverse line feeds

diction - identify wordy sentences 

diffmk - mark differences between files

dvips - convert TeX DVI files into PostScript

explain - explain phrases found by diction program

grap - pic preprocessor for drawing graphs 

hyphen - find hyphenated words 

ispell - check spelling interactively

latex - format text in LaTeX (based on TeX)

pdfelatex - latex with pdf output 

latex2html - Latex to html

lookbib - find bibliography references

macref - make cross-reference listing of nroff/troff macro files

ndx - create a subject-page index for a document

neqn - format mathematics with nroff

nroff - format text for simple display

pic - make simple pictures for troff input

psdit - filter troff output for Apple LaserWriter

ptx - make permuted index (not on CCWF)

refer - insert references from bibliographic databases 

roffbib - run off bibliographic database 

sortbib - sort bibliographic database 

spell - find spelling errors

ispell - interactive spell checker

style - analyze surface characteristics of a document 

tbl - format tables for nroff/troff

tex - format text

tpic - convert pic source files into TeX commands 

wget -  grab webpage

X windows

grabmode - info on screen: i.e. "1152x864"  51.213kHz/56.59Hz

import - grab window (i.e. import ppm:- >out.ppm)

xdpyinfo -  number of colors 

xkill - kill xwindow

xlock - lock screen

xterm - xterminal

xwininfo - information on open window

Web

html2ps - html to ps

latex2html - latex to html translator

lynx - text based webbrowser

netscape - webbrowser

sitecopy - sitecopy is for easily maintaining remote web sites.

weblint - html sytax and style checker

How to Determine UTM-1/Power-1 appliance series from CLI

If you want to know which appliance series you have, you can use a command line tool to determine this information.

Just run /usr/sbin/dmidecode | grep "Product Name"

Sample output:

[Expert@xxx-fw1]# /usr/sbin/dmidecode | grep "Product Name"
Product Name: U-30-00
Product Name:

[Expert@yyy-cp1]# /usr/sbin/dmidecode | grep "Product Name"
Product Name: C6P_UTM
Product Name: NSA-1086

Here are the translation for the information under the field Product Name:

• P-20-00 -> Power-1 9070 Appliance
• P-10-00 -> Power-1 5070 Appliance
• U-40-00 -> UTM-1 3070 Appliance
• U-30-00 -> UTM-1 2070 Appliance
• U-20-00 -> UTM-1 1070 Appliance
• U-15-00 -> UTM-1 570 Appliance
• U-10-00 -> UTM-1 270 Appliance
• U-5-00 -> UTM-1 130 Appliance
• C6P_UTM -> UTM-1 2050 Appliance
• C6_UTM -> UTM-1 1050 Appliance
• C2_UTM -> UTM-1 450 Appliance

Security Servers - daemon names and definitions

Security Servers and processes are grouped by function

1. Content and traffic management :
   
   
   • in.aftpd - FTP Security Server
   
   
   • in.ahttpd - HTTP Security Server
   
   
   • in.arlogind - rlogin Security Server
   
   
   • in.atelnetd - Telnet Security Server
   
   
   • in.asmtpd - SMTP Security Server (used to receive SMTP messages)
   • mdq - Mail DeQueuer daemon (delivers mail messages queued by in.asmtpd)
   
   
   • in.emaild.mta - E-Mail Security Server (Ant-Virus scanning of e-mails)
   • in.emaild.pop3 - POP3 Security Server (Ant-Virus scanning of e-mails)
   • in.emaild.smtp - SMTP Security Server (Ant-Virus scanning of e-mails)
   
   
   • in.aufpd - URL Filtering Protocol (UFP) daemon (communicates with UFP server)
   • in.ufclnt - URL Filtering Protocol Client (starting in R71 - part of URL Filtering engine in kernel)
   • in.ufsrvr - URL Filtering Protocol Server (starting in R71 - part of URL Filtering engine in kernel)
   
   
   • stormd - SmartDefense Storm Center Module
   
   
   • in.genericd - the TCP 'genericd' resource invokes a daemon, which is not a Security Server, but rather the mediator between the client, the CVP Server and the destination server
   
   
   
2. Authentication and load balancing :
   
   
   • in.asessiond - Session Authentication Security Server Agent
   
   
   • in.aclientd - Client Authentication process (port 259)
   
   
   • in.ahclientd - Client Authentication via Web (port 900). Executable starts when user initiates client authentication through a Web browser
   
   
   • in.lhttpd - Load Balancing daemon is the user mode process that handles HTTP requests, when the load balancing method is set to HTTP - listens for and redirects HTTP requests coming for load balancing
   
   
   • in.pingd - Load balancing or/and Client Authentication in Wait mode
   
   
   
3. VPN :
   
   
   • vpnd - VPN daemon
   
   
   • xrmd - Extranet Manager Process. If Gateway Module is defined as Extranet Enabled Gateway, public key can be shared with this process
   
   
   • sdsd - Software Distribution Server. Distributes software to SecureClient users
   
   
   • dtpsd - Desktop Policy Server. SecureClient users fetch policy from this
   
   
   • dtlsd - Desktop Log Server. Receives logs from SecureClient users
   
   
   • in.ahttpsd -Clientless VPN daemon

Security Gateway communication ports

Security Gateway communication ports

=============================

TCP Port 256 is used for:

• Exchange of CA and DH keys in FWZ and skip encryption between two Security Management servers.
• To fetch the network topology and encryption keys from a Security Management server.
• Security Management server uses this port to push the Security policy to the remote gateway.

TCP Port 257 is used for logging purposes.

TCP Port 258 is used by the remote GUI.

TCP Port 259 is used for Client Authentication.

UDP Port 259 is used in FWZ encryption to manage the encrypted session.

UDP Port 260 and UDP Port 261 are used for the SNMP daemon.

TCP Port 262 is used by netsod, which is the Single Sign-on Daemon.

TCP Port 264 is used by Secure Client to fetch the network topology and encryption keys from Security Management server. Security Gateway only listens to this port on a Security Management server.

UDP Port 500 is used for IKE negotiations.

TCP Port 900 is used by Client Authentication via HTTP.

TCP Port 4532 is used by the Session Authentication agent.

TCP Port 18181 is used for CVP (Content Vectoring Protocol). Security Gateway does not listen on this port.

TCP Port 18182 is used for UFP (URL Filtering Protocol). Security Gateway does not listen on this port.

TCP Port 18183 is used for SAM (Suspicious Activity Monitoring).

TCP Port 18184 is used for Log Export API (LEA).

TCP Port 18190 (CPMI) is used by FWM process to listen for SmartConsole attempting to connect to the Security Management server.

TCP Port 18191 (CPD) is used by the CPD process for communications such as Security policy installation, certificate revocation and status queries.

TCP Port 18192 (CPD_amon) is used by the CPD process for the Application Monitoring.

TCP Port 18196 is used for CPEPS which is part of User Monitor.

TCP Port 18207 is used by polsrvd, which is the Single Sign-on Daemon.

TCP Port 18210 (FW1_ica_pull): The CPD process, on the Security Management server, is listening on TCP port 18210 for certificates to be "pulled" by a gateway from a Security Management server.

TCP Port 18211 (FW1_ica_push): The Check Point Daemon (CPD) process, running on the gateway, listens on this port for the certificate creation and to "push" the certificate to the gateway from the Security Management server.

Checkpoint : clusterxl Down

Today I got a problem in one of the new firewall which I was building, cphaprob state "down" for one of the firewall, Definitely I decided to run chpaprob -i list command in the problematic box and I found that FIB is the creating the issue. Now what is FIB, fingers crossed....

[Expert@Firewall]# cphaprob -i list

Built-in Devices:

Device Name: Interface Active Check
Current state: problem

Device Name: HA Initialization
Current state: OK

Registered Devices:

Device Name: Synchronization
Registration number: 0
Timeout: none
Current state: OK
Time since last report: 96.5 sec

Device Name: Filter
Registration number: 1
Timeout: none
Current state: OK
Time since last report: 96.5 sec

Device Name: cphad
Registration number: 2
Timeout: 2 sec
Current state: OK
Time since last report: 0.3 sec

Device Name: fwd
Registration number: 3
Timeout: 2 sec
Current state: OK
Time since last report: 0.6 sec

Device Name: FIB
Registration number: 4
Timeout: none
Current state: problem
Time since last report: 7.8 sec


FIB - is nothing but responsible for dynamic routing in checkpoint, which I am not supposed to enable, I disabled it thru cpconfig and reboot (for safer side) fixed the issue...

Stupid issue made me mad for sometime...

IPSO - Terminate Service Gracefully

The ‘kill’ command can be used effectively to do this using the following process…



1. Locate the process identification number (PID) of the process you wish to terminate by running the command:

nokia[admin]# ps –auxwww

USER PID %CPU %MEM VSZ RSS TT STAT STARTED TIME COMMAND

root 1751 0.0 0.0 472 208 d0 R+ 11:50AM 0:00.01 ps -auxwww

root 1 0.0 0.0 356 172 ?? Is 8:19AM 0:00.01 /sbin/init --

root 2 0.0 0.0 0 0 ?? DL 8:19AM 0:00.00 (pagedaemon)

root 3 0.0 0.0 0 0 ?? DL 8:19AM 0:00.00 (vmdaemon)

root 4 0.0 0.0 0 0 ?? DL 8:19AM 0:00.30 (update)

root 133 0.0 0.1 1400 1120 ?? Is 8:21AM 0:00.08 /bin/pm

root 146 0.0 0.1 204 560 ?? Ss 8:21AM 0:00.08 /usr/sbin/syslogd -t -6

root 176 0.0 0.0 472 336 ?? I 8:21AM 0:00.02 /bin/csh -fb /opt/CPsuite-R65/svn/bin/cprid_wd

root 181 0.0 0.9 4996 7116 ?? I 8:21AM 0:00.33 /opt/CPsuite-R65/svn/bin/cprid

root 298 0.0 0.3 1128 2216 ?? Ss 8:21AM 0:00.73 /bin/httpd -d /web

root 310 0.0 0.3 7096 2404 ?? Ss 8:21AM 0:00.13 /bin/ipsrd -N

root 313 0.0 0.5 2244 3836 ?? Ss 8:21AM 0:12.67 /bin/xpand

root 314 0.0 0.1 764 1056 ?? Is 8:21AM 0:00.82 /bin/ifm /config/active

root 364 0.0 0.3 1080 2532 ?? Is 8:21AM 0:00.48 /opt/CPsuite-R65/svn/bin/cpwd

root 382 0.0 0.1 184 620 ?? Is 8:21AM 0:00.00 /usr/sbin/inetd -n

root 383 0.0 0.2 252 1204 ?? Is 8:21AM 0:00.01 /opt/CPsuite-R65/bin/ifwd

root 384 0.0 0.6 3012 4956 ?? Is 8:21AM 0:05.79 /bin/clishd default server

2. Terminate the process gracefully by running the command:

nokia[admin]# kill –HUP [PID of the process to be terminated]

NOTE: Some processes are monitored by the watchdog process which will respawn the process as soon as it is terminated.



To terminate a process which may be monitored by watchdog the following command may be used:

nokia[admin]# dbset process:[exact name of the process]

To restart a process terminated using the above method you can issue the following command:

nokia[admin]# dbset process:[exact name of the process] t

It is always a good idea (for good measure) to save any time to perform a dbset change by issuing the command:

nokia[admin]# dbset :save

============================

kill –HUP or Kill -9
dbset process:snmpd
dbset process:clishd
dbset process:httpd
dbset :save