Checkpoint : Memory

hmem

failures mean that the hmem is full. This is not a real memory problem, but indicates a configuration problem. If low hmem limit was configured, it leads to improper usage of the OS memory.

Possible reasons for

smem failures are: smem reached its limit, exhausted the OS memory or large non-sleep allocations. This can indicate some memory shortage.

kmem

failed allocations means that some applications did not get memory. his is usually an indication for a memory problem. The most common memory problem is memory shortage. Memory shortage sometimes indicates a memory leak. In order to troubleshoot memory shortage, stop the load and let connections close.

In case memory consumption went back to normal, you are not dealing with a memory leak. Such shortage might happen when traffic volumes are too high for the device capacity. If the memory shortage happens after a change in the system or the environment, undo the change, and check whether kmem memory consumption goes down.

Checkpoint : Delete old log files on SPLAT machines

There is no way to configure your SPLAT box or UTM-1 appliance in a way, that only logs for the last X days were kept.

The only work-around would be to configure on the firewall object -> Logs and Masters -> Required Free Disc Space together with the option Do not delete log files from the last X days.

By configuring a very high value for required free disc space you could have the script run every day and with the other option prevent it from deleting the needed logs.

OR – you could implement a short script:

[Expert@fw1]# cat /usr/bin/del_logs.sh

#!/bin/bash

/usr/bin/find /var/log/opt/CPsuite-R65/fw1/*.log* -ctime +217 -print -exec rm -f {} \;

The parameter ctime is the amount of days for the logs to keep.

Run the script with cron:

[Expert@fw1]# crontab -l

# DO NOT EDIT THIS FILE - edit the master and reinstall.

# (/tmp/crontab.19431 installed on Mon May 10 10:21:33 2010)

# (Cron version -- $Id: crontab.c,v 2.13 1994/01/17 03:20:37 vixie Exp $)

42 11 * * * /usr/bin/del_logs.sh

50 2 * * 1,2,3,4,5,6,7 backup_util sched

Now you’re able to delete the old logs as you like. If you backup your firewall or SmartCenter to your local disc, maybe you want to do this with your backups, too?

Checkpoint - SecureXL

When SecureXL is enabled, all traffic that matches following conditions will not be accelerated:

* The first packets of any new TCP session, unless a "template" exists.
* The first packet of any new UDP session.
* All traffic that matches a service that uses a resource.
* All traffic that matches a service that is inspected by a SmartDefence or Web Intelligence feature.
* All traffic that is supposed to be dropped or rejected, according to the rule base.
* All traffic that matches a rule, whose source or destination is the gateway itself.
* All traffic that matches a rule with a security server.
* All traffic that matches a rule with user authentication or session authentication.
* Non-TCP/UDP/GRE/ESP trafic (e.g. ICMP, IGRP, etc.)
* All multicast traffic. **** Prior to IPSO-3.9. In IPSO-3.9 has support for Multicast PIM acceleration for IP225x. IPSO-4.2 supports Multicast PIM acceleration for all Nokia Platforms.
* All fragmented traffic.
* All traffic with IP options.
* RST packets, when the "Spoofed Reset Protection" feature is activated.
* Traffic that violates stateful inspection paradigm or that is suspected to be spoofed.
* Rules where the service has an INSPECT handler (e.g. FTP control connection)
* Rules with action "encrypt" with no VPN H/W Accelerator card.
* All VoIP traffic
* All VPN traffic with IP Compression enabled.
* All directed broadcast traff

Connection establishment acceleration ("templates" mechanism)

In order to enhance connection establishment acceleration, a mechanism attempts to "group together" all connections that match a particular service and whose sole discriminating element is the source port. This type of "grouping" enables even the very first packets of a TCP handshake to be accelerated. This is very useful on short connections, in which the percentage of TCP handshake traffic is very high.

The very first packets of the first connection on the same service will be forwarded to the security gateway, which will then create a "template" of the connection and notify the SecureXL device. Any subsequent TCP establishments on the same service (where only the source port is different) will already be accelerated (as well as any other traffic, of course).

Conditions that will prevent a template from being created:

* All connections that cannot be discriminated ONLY by the source port.
* Traffic subject to NAT.
* VPN traffic.
* Non-trivial TCP/UDP connections (FTP, H323, etc.).
* Non-TCP/UDP traffic.

FTP : Active/Passive Modes

FTP
===

Two types - Active and Passive

Passive : Client will always intaiate connection
------------------------------------------------

1. Client:Hightport -> server:21
2. Server will reply with a hightend port (>1023) in PORT command
3. Client:Hightport -> Server : high port (which server replied with port command)
4. Server will ACK the 3rd step

Passive FTP :

command : client >1023 -> server 21
data : client >1023 -> server >1023

Active : Both Client and Server intaiates connection
----------------------------------------------------

1. Client:HighPOrt->Server:21 and issues port command with (Highport+1) say 1024+1=1025 to connect back
2. Server :21-> Client : Highport :- Server ACK the connection
3. Server : 20->Client:Hightport+1 (the one mentioned in the port command in step 2)
4. Client:Hightport+1->server: 20 :- Client Send ACK to Server

Active FTP :
command : client >1023 -> server 21
data : client >(1023+1) <- server 20

HP : ILO : CLI

ust ssh to the IP that you configured the iLO

admin@shellcore:~ $ ssh admin@192.168.50.118
admin@192.168.50.118′s password:
User: admin logged-in to ILO_TESTLABHP.(192.168.50.118)
iLO 2 Advanced Evaluation 1.81 at
Server Name: proliant_g5
Server Power: On

hpiLO->

Since I will access through a text terminal, Linux is configured to use the serial port (configured through the file /boot/grub/grub.conf)

hpiLO-> help
status=0
status_tag=COMMAND COMPLETED

DMTF SMASH CLP Commands:

help : Used to get context sensitive help.
show : Used to show values of a property or contents of a collection target.
create : Used to create new user account in the name space of the MAP.
Example: create /map1/accounts1 username= password=
name=
group=

delete : Used to delete user account in the name space of the MAP.
Example: delete /map1/accounts1/

load : Used to move a binary image from an URL to the MAP. The URL is
limited to 80 characters
Example : load -source http://192.168.1.1/images/fw/iLO2_130.bin

reset : Used to cause a target to cycle from enabled to disabled and back to
enabled.

set : Used to set a property or set of properties to a specific value.
start : Used to cause a target to change state to a higher run level.
stop : Used to cause a target to change state to a lower run level.
cd : Used to set the current default target.
Example: cd targetname

exit : Used to terminate the CLP session.
version : Used to query the version of the CLP implementation or other CLP
elements.

oemhp_ping : Used to determine if an IP address is reachable from this iLO 2.
Example : oemhp_ping 192.168.1.1 , where 192.168.1.1 is the IP address that you wish
to ping

oemhp_loadSSHKey : Used to authorize a SSH Key File from an URL The URL is
limited to 80 characters
Example : oemhp_loadSSHKey -source http://UserName:password@192.168.1.1/images/SSHkey1.ppk

HP CLI Commands:

POWER : Control server power.
UID : Control Unit-ID light.
NMI : Generate an NMI.
VM : Virtual media commands.
VSP : Invoke virtual serial port.

Type VSP and you’re in. To login as root you need to include the serial port (in this case ttyS1) on your /etc/securetty file or you will be given the error message that your user or password is wrong.

hpiLO-> VSP

Starting virtual serial port.
Press ‘ESC (‘ to return to the CLI Session.

hpiLO-> Virtual Serial Port active: IO=0x02F8 INT=3

login as:

To exit, press Esc and then ( – left parenthesis

Checkpoint : SNMP Support : cpsnmpd

urrently, cpsnmpd only support SNMP version 1. As shown in last line of /var/etc/snmpd.conf.

proxy -v 1 -p 260 -c public localhost .1.3.6.1.4.1.2620

Check Point snmp daemon (cpsnmpd) process is binded to port 260 (as opposed to the default port 161). cpsnmpd can be enabled via cpconfig [select 'SNMP Extensions'] or $FWDIR/bin/cpsnmpd -p 260 command. Since IPSO 3.1, IPSO is able to act as proxy to poll Checkpoint MIBs. I.e, user can poll Checkpoint MIB via port 161.

The following shows the output of snmp polling on port 260 using snmp version 1 & 2c. 'public' was used as snmp community name.

SNMP polling was successfully when SNMP version 1 was used

[root@linux root]# snmpwalk -v 1 -c public 10.58.18.70:260 -On .1.3.6.1.4.1.2620.1.1.25.1.0

.1.3.6.1.4.1.2620.1.1.25.1.0 = STRING: "Standard"

[root@linux root]#

SNMP polling failed when SNMP version 2c was used

[root@linux root]# snmpwalk -v 2c -c public 10.58.18.70:260 -On .1.3.6.1.4.1.2620.1.1.25.1.0

Timeout: No Response from 10.58.18.70:260

[root@linux root]#

SNMP polling using v2c without port 260 was successful

[root@linux root]# snmpwalk -v 2c -c public 10.58.18.70 .1.3.6.1.4.1.2620.1.1.25.1.0

SNMPv2-SMI::enterprises.2620.1.1.25.1.0 = STRING: "Standard"

[root@linux root]#

Monitoring Checkpoint Firewalls with SNMP

I've been doing some work for a client with Checkpoint Firewalls (running Secure Platform, or SPLAT), and wanted to monitor them using SNMP. The two main reasons being;

1. To graph Accepted/Dropped/Rejected packets over time and

2. To Poll the Firewalls for status using 3rd Party Management Tools like "Whats Up Gold" and "BMC Patrol".

So a brief summary of what I had to do to get it to work correctly:

1. Enable SNMPD

chkconfig snmpd on

service snmpd start

2. Edit /etc/snmp/snmpd.conf
Add "rocommunity NotPublicCommunityString 192.168.0.1"

Add "proxy -v1 -c public 127.0.0.1:260 .1.3.6.1.4.1.2620"

3. Edit $FWDIR/conf/snmp.C

Add :snmp_community (
:read (“public”)
:write(“private”)
)

4. Run cpconfig, and enable the cpsnmpd extension

5. Add required security rule to permit access to the firewall from the management server(s) (SNMP-UDP/161) (You don't need to permit access to cpsnmpd-UDP/260)

Following these changes you should be able to do a 'netstat -an' and see the cpsnmpd listening on :260, and perform a local snmp check:

snmpwalk -v1 -c public localhost 1.3.6.1.4.1.2620.1.6

Gotchas to note:

1. The local snmpwalk above uses the "public" string - the one in snmp.C - NOT the one in snmpd.conf

2. snmpwalk from a remote host uses the "NotPublicCommunityString" - not "public"

3. snmpwalk locally (and maybe remotely) using just the OID 1.3.6.1.4.1.2620 causes the cpsnmpd process to die (need to restart it using '$CPDIR/bin/cpsnmpd -p 260' or cpstop, cpstart)

Once the above are done the management servers can query the enforcement module for Checkpoint SNMP OIDs, such as accepted packets, dropped packets and Checkpoint OS OIDs like CPU usage (accurate), memory usage etc. These queries go to the Firewall on UDP/161 and internally the snmpd process proxies the snmp request for OID .1.3.6.1.4.1.2620 (checkpoint) to the cpsnmpd process on UDP/260.

This happens by default in Nokia IPSO, but not on SecurePlatform.

Some good OIDs to Graph:

Active Real Memory .1.3.6.1.4.1.2620.1.6.7.4.4.0
Total Real Memory .1.3.6.1.4.1.2620.1.6.7.4.3.0
Packets accepted .1.3.6.1.4.1.2620.1.1.4.0
Packets dropped .1.3.6.1.4.1.2620.1.1.6.0
Packets rejected .1.3.6.1.4.1.2620.1.1.5.0
Packets logged .1.3.6.1.4.1.2620.1.1.7.0
Current connections .1.3.6.1.4.1.2620.1.1.25.3.0
Processor (System) .1.3.6.1.4.1.2620.1.6.7.2.2.0
Processor (User) .1.3.6.1.4.1.2620.1.6.7.2.1.0

And good OIDs to monitor for status:
Firewall Module State (Installed) .1.3.6.1.4.1.2620.1.1.1.0
Processor Usage .1.3.6.1.4.1.2620.1.6.7.2.4.0

Useful Links:

Cacti - An excellent (+free) web front end to MRTG/RRD-Tool

Cacti Templates Index - Although the supplied Checkpoint/Nokia ones didnt work for me without customisation. I created some more graphs and data sources using the above OIDs.

What's Up Gold - The new version is very nice. Excellent Web based multi-user UI.