Checkpoint : Rules from Gateway

sed "/:rules-adtr/,/^$/d" rules.C | egrep ": |:action|:disabled|:global_

location|:through|:time|:track|:dst|:install|:services|:src" | more

http://www.networksandsecurity.com/home/2009/08/24/recovering-from-a-dead-check-point-smartcenter/

Checkpoint : Policy Load From Management Server / Provider-1 / Smartcentre Server

To Load Policy from Management Server

fwm load

And ofcoz good practice to enable logging when u are in trouble

fwm load -d

Checkpoint Firewall Logs from CLI

Syntax
fw log displays the content of log files. The full syntax of the fw log command is as follows:

fw log [-f [-t]] [-n] [-l] [-o] [-c action] [-h host] [-s starttime] [-e endtime] [-b starttime endtime] [-u unification_scheme_file] [-m unification_mode(initial|semi|raw)] [-a] [-k (alert_name|all)] [-g] [logfile]

Optional Switches
The optional switches for fw log are as follows:

-f [-t]
After reaching the end of the currently displayed file, do not exit (the default behavior), but continue to monitor the log file indefinitely, and display it while it is being written. The -t parameter indicates that the display is to begin at the end of the file. The display will initially be empty, and only new records added later will be displayed. -t is used with a -f flag. These flags are relevant only for active files.

-n
Do not perform DNS resolution of the IP addresses in the log file (the default behavior). This option significantly speeds up processing.

-l
Display both the date and the time for each log record. (The default is to show the date only once above the relevant records, and then specify the time per log record.)

-o
Show detailed log chains (all log segments a log record consists of).

-c action
Display only events whose action is action, i.e., accept, drop, reject, authorize, deauthorize, encrypt, and decrypt. Control actions are always displayed.

-h host
Display only the log whose origin is the specified IP address or name.

-s starttime
Display only events that were logged after the specified time. (See format below.) starttime may be a date, time, or both. If the date is omitted, today’s date is assumed.

-e endtime
Display only events that were logged before the specified time. (See format below) endtime may be a date, a time, or both.

-b starttime endtime
Display only events that were logged between the specified start and end times (format below), each of which may be a date, time, or both. If date is omitted, today’s date is assumed. The start and end times are expected after the flag.

-u unification_scheme_file
Unification-scheme filename. (The unification-scheme specifies the precise manner, in which logs are processed, per selected unification mode.)

-m unification_mode
This flag specifies the unification mode.
* initial - the default mode, specifying complete unification of log records; i.e., output one unified record for each ID (default). When used together with -f, no updates, but only entries relating to the start of new connections will be displayed. To display updates, use the semi parameter.
* semi - step-by-step unification; for each log record, output a record that unifies this record with all previously-encountered records with the same ID.
* raw - outputs all records, with no unification.

-a
Output account-log records only.

-k alert_name
Display only events that match a specific alert type. The default is all, for any alert type.

-g
Do not use a delimited style. The default is:
* : after field name
* ; after field value

logfile
Use logfile instead of the default log file. The default log file is $FWDIR/log/fw.log.

DATE & TIME FORMAT:
The full date-and-time format is: MMM DD, YYYY HH:MM:SS (for example: May 26, 1999 14:20:00)

It is possible to specify date only in the format MMM DD, YYYY, or time only, in the format: HH:MM:SS. In the format, where time only is specified, the current date is assumed.

Examples:

fw log
fw log | more
fw log -c reject
fw log -s "May 26, 1999"
fw log -f -s 16:00:00

Checkpoint Debug - Very Much Usefull

Usage :

fw debug TDERROR_ALL_ALL=

Debugging CPD :

CPD is a high in the hierarchichal chain and helps to execute many services, such as Secure
Internal Communcation (SIC), Licensing and status report.

For CPD debug, execute:

cpd_admin debug on TDERROR_ALL_ALL=5

The debug file is located under $CPDIR/log/cpd.elg

To stop the CPD debug, execute: % cpd_admin debug off TDERROR_ALL_ALL=1

Debugging FWM:

The FWM process is responsible for the execution of the database activities of the
SmartCenter server. It is; therefore, responsible for Policy installation, Management High
Availability (HA) Synchronization, saving the Policy, Database Read/Write action, Log
Display, etc.

For FWM debug, execute:

fw debug fwm on TDERROR_ALL_ALL=5
fw debug fwm on OPSEC_DEBUG_LEVEL=9
The debug file is located under $FWDIR/log/fwm.elg

To stop the FWM debug, execute:

fw debug fwm off TDERROR_ALL_ALL=1
fw debug fwm off OPSEC_DEBUG_LEVEL=1

Debugging FWD :

The FWD process is responsible for logging. It is executed in relation to logging, Security
Servers and communication with OPSEC applications.

For FWD debug, execute: fw debug fwd debug on TDERROR_ALL_ALL=5

The debug file is located under $FWDIR/log/fwd.elg

To stop the FWD debug, execute: % fw debug fwd off TDERROR_ALL_ALL=1


TIP : echo $TDERROR_ALL_ALL will let you know the debug level

Checkpoint : Nokia : See Memory/CPU

In Voyager Monitor option select CPU and Memory Utilization . This gives you the Total Real Memory, Active Real Memory and the Free Memory available on the appliance.

For console access use clish to display the Real Memory Used. This value is displayed in terms of percentage value.

ipso[admin]# clish

clish:1> show useful-stats



Components Total

Active Routes 4

Packets Forwarded 0

VRRP Masters 0

Real Memory Used 22%

Disk Capacity 11%

Note: The real physical memory output gathered from Voyager is taken from the kernel directly.

The art of network debugging with tcpdump

The art of network debugging with tcpdump

Introduction
Tcpdump is powerful tool for network monitoring and data acquisition it’s working as Swiss knife for network troubleshooting. tcpdump simply powerful application dump traffic on a network this is what tcpdum created for it’s not creates to be analyzer like Wireshark however every application have it’s usage.
Tcpdump give you data without any prejudgment and let burden of analysis is placed directly on the user rather than the application this will sharp your skills and give you deep understand how the protocol work. i notes this happen in almost everything around us and this one of thing make Linux most powerful OS it’s not make user depend in application in the same time it give him tools this Linux beauty

Promiscuous mode
Promiscuous mode is a configuration of a network card that makes the card pass all traffic it receives to the central processing unit rather than just packets addressed to, In Linux root privileges is require to enable promiscuous mode.

How Tcpdump work and howto use ?
Tcpdump must be able to put the interface (typically an Ethernet) into promiscuous mode to read all the network traffic and decode it. tcpdump is use like any other Linux command and it’s installed by default in many Linux distribution

Basic and essential options
The most essential options in tcpdump is -i option which tell tcpdump which interface to put in promiscuous mode and listen to the traffic will coming. another favorite option is -n, which requests that don’t convert addresses (i.e., host addresses, port numbers, etc.) to names this save time and run faster plus in most case we troubleshooting ip not the names. here is the full list for common used options:

-D	Print the list of the network interfaces available on the system and on which tcpdump can capture packets. This can be useful on systems that don’t have a command to list them (e.g. Windows systems)
-i	Listen on interface. If unspecified, tcpdump searches the system interface list for the lowest numbered, configured up interface (excluding loopback).
-vvv	Increase the amount of packet information you get
-c	Exit after receiving count packets.
-n	Don’t convert addresses (i.e., host addresses, port numbers, etc.) to names.
-C	Specifies the size the dump file must reach before a new one with a numeric extension is created. The units of file_size are millions of bytes (1,000,000 bytes, not 1,048,576 bytes).
-F	Use file as input for the filter expression. An additional expression given on the command line is ignored.
-S	Print absolute sequence numbers.
-p	Don’t put the interface into promiscuous mode.
-r	Read packets from file (which was created with the -w option). Standard input is used if file is ‘‘-’’.
-t	Don’t print a timestamp on each dump line.
-X	When parsing and printing, in addition to printing the headers of each packet, print the data of each packet (minus its link level header) in hex and ASCII. This is very handy for analysing new protocols.
-XX	When parsing and printing, in addition to printing the headers of each packet, print the data of each packet, including its link level header, in hex and ASCII.
-E	Print the link-level header on each dump line.
-z	Drops privileges (if root) and changes user ID to user and the group ID to the primary group of user.

Basic Example

List of supported NIC that can be used by tcpdump

[root@Machine ~]# tcpdump -D 1.eth0 2.any (Pseudo-device that captures on all interfaces) 3.lo

Capture all traffic path in eth0 then write it to file name tcpdumpfile and set the each file size to be around 3M without trying to resolve IP/Port name

[root@Machine ~]# tcpdump -nnxX -i eth0 -w tcpdumpfile -C 3 tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 82 packets captured 166 packets received by filter 0 packets dropped by kernel

Expressions:
Searching in the Network traffic like searching in the ocean, you need to know exactly what you searching for. tcpdump can really collect huge a amount of traffic so you need to guide tcpdump which kind of traffic you intersing in this can be done with expression.
The expression consists of one or more primitives. Primitives usually consist of an id (name or number) preceded by one or more qualifiers.There are three different kinds of qualifier
type: Possible types are host, net , port and portrange. E.g., ‘host foo’, ‘net 128.3’, ‘port 20’, ‘portrange 6000-6008’. If there is no type qualifier, host is assumed.
dir: Possible directions are src, dst, src or dst and src and dst. E.g., ‘src foo’, ‘dst net 128.3’, ‘src or dst port ftp-data’. If there is no dir qualifier, src or dst is assumed.
proto: Possible protos are: ether, fddi, tr, wlan, ip, ip6, arp, rarp, decnet, tcp and udp. E.g., ‘ether src foo’, ‘arp net 128.3’, ‘tcp port 21’, ‘udp portrange 7000-7009’. If there is no proto qualifier, all protocols are assumed.

host ip-address/hostname	True if either the IPv4/v6 source or destination of the packet is ip-address/hostname also can be used with dst host and src host
port number/port-name	True if either the source or destination port of the packet is number/port-name also can be used with dst port and src port
portrange numbe1-number2	True if either the source or destination port of the packet is between number1 and number2 also can be used with dst portrange and src portrange
ether host MAC	True if either the Ethernet source or destination address is MAC also can be used ether src and ether dst
ether broadcast	True if the packet is an Ethernet broadcast packet. and broadcast can be use directly
gateway ip-address	True if the packet used ip-address as a gateway
net network-address	True if either the IPv4/v6 source or destination address of the packet has a network number of network-address. also can be used with src net and dst net
ip broadcast	True if the packet is an IPv4 broadcast packet.
vlan vlan_id	True if the packet is an IEEE 802.1Q VLAN packet. If [vlan_id] is specified, only true if the packet has the specified vlan_id
mpls label_num	True if the packet is an MPLS packet. If [label_num] is specified, only true is the packet has the specified label_num
vpi /vci number	True if the packet is an ATM packet,with a virtual path/channel identifier of number
less/greater length	True if the packet has a length less/greater than or equal to length

More Example

To print all packets arriving from or departing to 10.0.2.2

[root@server ~]# tcpdump -nnvvv -i eth0 host 10.0.2.2 tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 07:14:13.748986 IP (tos 0×0, ttl 64, id 0, offset 0, flags [DF], proto: ICMP (1), length: 84) 10.0.2.15 > 10.0.2.2: ICMP echo request, id 56073, seq 1, length 64 07:14:13.749484 IP (tos 0×0, ttl 255, id 6544, offset 0, flags [DF], proto: ICMP (1), length: 84) 10.0.2.2 > 10.0.2.15: ICMP echo reply, id 56073, seq 1, length 64

capture all traffic dst to http port and coming form my loop back interface

[root@server ~]# tcpdump -vvv -i lo dst port http tcpdump: listening on lo, link-type EN10MB (Ethernet), capture size 96 bytes 07:18:39.937891 IP (tos 0×0, ttl 55, id 52591, offset 0, flags [none], proto: TCP (6), length: 44) server.36901 > 10.0.2.15.http: S, cksum 0xc515 (correct), 1306286511:1306286511(0) win 4096 07:18:40.937973 IP (tos 0×0, ttl 39, id 62265, offset 0, flags [none], proto: TCP (6), length: 44) server.36902 > 10.0.2.15.http: S, cksum 0xc514 (correct), 1306352046:1306352046(0) win 4096

capture all Address Resolution Protocol (ARP) packets

[root@server ~]# tcpdump -nnevvv -c 3 arp tcpdump: listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 07:23:47.914195 08:00:27:ed:89:bd > ff:ff:ff:ff:ff:ff, ethertype ARP (0×0806), length 42: arp who-has 10.0.2.3 tell 10.0.2.15 07:23:47.914514 52:54:00:12:35:03 > 08:00:27:ed:89:bd, ethertype ARP (0×0806), length 60: arp reply 10.0.2.3 is-at 52:54:00:12:35:03 07:23:54.698897 08:00:27:ed:89:bd > ff:ff:ff:ff:ff:ff, ethertype ARP (0×0806), length 42: arp who-has 10.0.2.2 tell 10.0.2.15 3 packets captured 7 packets received by filter 0 packets dropped by kernel

Try to capture icmp traffic AND to or from the host 10.0.2.2

[root@server ~]# tcpdump -nn icmp host 10.0.2.2 tcpdump: ‘icmp’ modifier applied to host [root@server ~]#

In last example we was trying to use tow valid expressions with tcpdump but How come tcpdump know and differentiate this tow expressions ?? answer: with combine them

Expressions combination
Tcpdump understanding boolean operators (AND, NOT, OR). grouping this boolean operators between the expressions can create any rule limited only with your imagination.
Boolean operators define the relationships between expressions or groups of expressions. The relationship can be True or False and depend in this tcpdump will take the resolution to capture the packet or not

• AND (and == && ) Give True ONLY AND ONLY IF both expression True else give False
• NOT (not == !) Reverse the resolution if it was Ture it will be False and if it was False it will be True
• OR (or == ||) Give False ONLY AND ONLY IF both expression False else give True

Advanced Example

All IP packets between 10.0.2.15 and any host except 10.0.2.2

[root@server ~]# tcpdump -c 10 ip host 10.0.2.15 and not 10.0.2.2 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 08:08:14.352939 IP 10.0.2.15.ssh > 192.168.99.166.38395: P 2998871938:2998872054(116) ack 155036726 win 35420 08:08:14.365762 IP 192.168.99.166.38395 > 10.0.2.15.ssh: . ack 116 win 8760 08:08:14.367732 IP 10.0.2.15.ssh > 192.168.99.166.38395: P 116:232(116) ack 1 win 35420 08:08:14.368449 IP 192.168.99.166.38395 > 10.0.2.15.ssh: . ack 232 win 8760 08:08:14.356135 IP 10.0.2.15.35379 > 10.0.2.3.domain: 19282+ PTR? 166.99.168.192.in-addr.arpa. (45) 08:08:14.358604 IP 10.0.2.3.domain > 10.0.2.15.35379: 19282 NXDomain* 0/1/0 (130) 08:08:14.360064 IP 10.0.2.15.56712 > 10.0.2.3.domain: 44586+ PTR? 15.2.0.10.in-addr.arpa. (40) 08:08:14.362235 IP 10.0.2.3.domain > 10.0.2.15.56712: 44586 NXDomain 0/1/0 (117) 08:08:14.365138 IP 10.0.2.15.ssh > 192.168.99.166.38395: P 232:396(164) ack 1 win 35420 08:08:14.365603 IP 192.168.99.166.38395 > 10.0.2.15.ssh: . ack 396 win 8760 10 packets captured 39 packets received by filter 0 packets dropped by kernel

Capture packets related with Mail , Web and FTP service

[root@server ~]# tcpdump -c 3 -i eth0 port smtp or http or ftp-data or ftp tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 08:13:45.441400 IP 10.0.2.15.47362 > 10.0.2.2.smtp: S 2545888906:2545888906(0) win 2048 08:13:45.452871 IP 10.0.2.15.47362 > 10.0.2.2.smtp: R 2545888907:2545888907(0) win 0 08:13:50.663261 IP 10.0.2.15.41938 > 10.0.2.2.ftp: S 846604284:846604284(0) win 1024 3 packets captured 6 packets received by filter 0 packets dropped by kernel

Capture only traffic from Internet

[root@server ~]# tcpdump -c 5 -nn -i eth0 ’src net not 192.168.0.0/16 and not 10.0.0.0/8′ tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 08:24:51.413583 IP 87.248.113.14.80 > 10.0.2.15.50484: S 1979840001:1979840001(0) ack 18214165 win 8192 08:24:51.418167 IP 87.248.113.14.80 > 10.0.2.15.50484: . ack 121 win 8760 08:24:51.453019 IP 87.248.113.14.80 > 10.0.2.15.50484: P 1:1025(1024) ack 121 win 8760 08:24:51.463017 IP 87.248.113.14.80 > 10.0.2.15.50484: P 1025:2049(1024) ack 121 win 8760 08:24:51.468393 IP 87.248.113.14.80 > 10.0.2.15.50484: P 2049:3073(1024) ack 121 win 8760 5 packets captured 10 packets received by filter 0 packets dropped by kernel

Capture ftp and http

[root@server ~]# tcpdump -nn -i eth0 src host 10.0.2.15 and ‘dst port 21 or 80′ tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 96 bytes 08:28:14.867601 IP 10.0.2.15.36888 > 72.232.194.162.80: . ack 3094288542 win 3072 08:28:15.048748 IP 10.0.2.15.36867 > 72.232.194.162.21: S 3753909241:3753909241(0) win 3072 08:28:15.149659 IP 10.0.2.15.36868 > 72.232.194.162.21: S 3753974776:3753974776(0) win 3072 08:28:17.362931 IP 10.0.2.15.60855 > 72.232.194.162.80: . ack 1168658718 win 1024 08:28:17.478546 IP 10.0.2.15.60831 > 72.232.194.162.80: S 2859656818:2859656818(0) win 2048 08:28:17.554347 IP 10.0.2.15.60831 > 72.232.194.162.80: R 2859656819:2859656819(0) win 0 6 packets captured 12 packets received by filter 0 packets dropped by kernel

Problems and hints
No output
Check to make sure you’re specifying the correct network interface with the -i option, which I suggest you always use explicitly. If you’re having DNS problems, TCPdump might hang trying to lookup DNS names for IP addresses, try the -f or -n options to disable this feature. If you still see nothing, check the kernel interface – TCPdump might be mis-configured for your system.

Dropped packets
At the end of its run, TCPdump will inform you if any packets were dropped in the kernel. If this becomes a problem, it’s likely that your host can’t keep up with the network traffic and decode it at the same time. Try using TCPdump’s -w option to bypass the decoding and write the raw packets to a file, then come back later and decode the file with the -r switch. You can also try using -s to reduce the capture snapshot size.

Messages that end like [|rip] and [|domain]
Messages ending with [|proto] indicate that the packet couldn’t be completely decoded because the capture snapshot size (the so-called “snarf
length”) was too small. Increase it with the -s switch.

VRRP : Error when adding New Virtual Server

Symptoms

When configuration a new VRID under the VRRP configuration pager is returning an error "error per-interface MC-VRRP configuration is present please remove the per interface MC_VRP configuration before using simple MC-VRRP configuration". A new VRID can not be added due to this error.

Solution

This error occurs when old VRRP setting are not fully removed. To correct this issue you will need to manually remove the old configurations from command line. The steps are outline as followed.

1. Determine the old VRRP setting

ip260[admin]# dbget -rv ipsrd:instance:default:vrrp:interface

This will produce an output of the current VRRP setting.

nokia[admin]# dbget -rv ipsrd:instance:default:vrrp:interface

ipsrd:instance:default:vrrp:interface:eth1c0 t

ipsrd:instance:default:vrrp:interface:eth1c0:mode monitoredcircuit

ipsrd:instance:default:vrrp:interface:eth1c0:virtualrouter:123 t

ipsrd:instance:default:vrrp:interface:eth1c0:virtualrouter:123:address:addr:10.207.143.113 t

ipsrd:instance:default:vrrp:interface:eth1c0:virtualrouter:123:advertiseinterval 1

ipsrd:instance:default:vrrp:interface:eth1c0:virtualrouter:123:monitor:monif:eth2c0 t

ipsrd:instance:default:vrrp:interface:eth1c0:virtualrouter:123:monitor:monif:eth2c0:priority 10

ipsrd:instance:default:vrrp:interface:eth1c0:virtualrouter:123:priority 100

2. Copy the line that indicates "mode".

nokia[admin]# dbget -rv ipsrd:instance:default:vrrp:interface

ipsrd:instance:default:vrrp:interface:eth1c0 t

ipsrd:instance:default:vrrp:interface:eth1c0:mode monitoredcircuit

ipsrd:instance:default:vrrp:interface:eth1c0:virtualrouter:123 t

ipsrd:instance:default:vrrp:interface:eth1c0:virtualrouter:123:address:addr:10.207.143.113 t

ipsrd:instance:default:vrrp:interface:eth1c0:virtualrouter:123:advertiseinterval 1

ipsrd:instance:default:vrrp:interface:eth1c0:virtualrouter:123:monitor:monif:eth2c0 t

ipsrd:instance:default:vrrp:interface:eth1c0:virtualrouter:123:monitor:monif:eth2c0:priority 10

ipsrd:instance:default:vrrp:interface:eth1c0:virtualrouter:123:priority 100

3. Issue the command:

nokia[admin]# dbset ipsrd:instance:default:vrrp:interface:eth1c0:mode

This command turns the mode from monitoredcircuit to none. You will do this to all the interface you would like to disable VRRP



4. Issue the command

nokia[admin]# dbset save

This command will save the configuration