Checkpoint - Smart View Monitor - Cashed Info

Sometimes SmartView Monitor gets confused and it displaying wrong (cached) information.

To clear this up you do the following:

- issue cpstop on the Security Management server
- delete $FWDIR/conf/applications.C,
$FWDIR/conf/applications.C.backup,
$FWDIR/conf/CPMILinksMgr.db
and $FWDIR/conf/CPMILinksMgr.db.private
- issue cpstart
- install policy again
- open SmartView Monitor again

Checkpoint : Mount USB Memory Stick / Pen Drive to Splat

Ever wanted to use an USB stick on OpenServer using SPLAT or an appliance?

Just connect the device to an USB port of your choice.

1. Load the appropriate kernel module for handling the USB device
modprobe usb-storage

2. Check which new device was bound, for example /dev/sda1
fdisk -l

3. Create a mount point
mkdir /mnt/usbdisk

4. Mount USB device
mount /dev/sdb1 /mnt/usbdisk

5. Use the device to transfer data as you like

6. Unmount USB device
umount /mnt/usbdisk

How to exclude or include files in the SecurePlatform Backup utility

You can see all the backup schemes in the /var/CPbackup/schemes directory on the SecurePlatform machine. The following schemes are listed: Scheme Name Description cvpn.cpbak Connectra module dtps.cpbak Desktop Policy server (SecureClient) fg1.cpbak Floodgate fw1.cpbak Firewall fw1logs.cpbak Firewall logs gated.cpbak gated ppak.cpbak Performance Pack rt.cpbak Eventia Reporter rtm.cpbak SmartView Monitor snapshot.cpbak Snapshot utility svn.cpbak CPDIR system_configuration.cpbak System configuration uag.cpbak User authentication To include files in the SecurePlatform Backup utility: Access one of the desired schemes (e.g. fw1.cpbak) via a text editor. Search for the line . Add the desired files. Please note that the path must be specified between the tags and . To exclude files in the SecurePlatform Backup utility: Access one of the desired schemes (e.g. fw1.cpbak) via a text editor. Search for the line . Specify the files that you do not want to backup. Please note that the path must be specified between the tags and . Note: You can use "*" to include all files in a specific directory, for example, /var/opt/CPsuite-R65/fw1/conf/*.

Checkpoint - SNMP Monitoring - OID

When you have configured SNMP and Check Point SNMP Extensions on your systems, you can start with system monitoring.

For Nagios we have some plugins available and other vendors also have pre-installed checks for Check Point equipment build into their products.

If you don’t want to use extra plugins you may use the check_snmp plugin command that is delivered with Nagios.

SVN Status
/usr/lib/nagios/plugins/check_snmp -H $HOSTADDRESS$ -C $ARG1" -o 1.3.6.1.4.1.2620.1.6.102.0 -s "\"OK\"" -l "SVN Status"

Security Gateway Policy Status
/usr/lib/nagios/plugins/check_snmp -H $HOSTADDRESS$ -C $ARG1$ -o 1.3.6.1.4.1.2620.1.1.1.0 -s "\"Installed\"" -l "Security Gateway Policy Status"

Security Gateway High Availability Status
/usr/lib/nagios/plugins/check_snmp -H $HOSTADDRESS$ -C $ARG1$ -o 1.3.6.1.4.1.2620.1.5.102.0 -s "\"OK\"" -l "Security Gateway High Availability Status"

Security Gateway High Availability Modus
/usr/lib/nagios/plugins/check_snmp -H $HOSTADDRESS$ -C $ARG1$ -o 1.3.6.1.4.1.2620.1.5.6.0 -s "\"active\"" -l "Security Gateway High Availability Modus"

Security Gateway High Availability Modus
/usr/lib/nagios/plugins/check_snmp -H $HOSTADDRESS$ -C $ARG1$ -o 1.3.6.1.4.1.2620.1.5.6.0 -s "\"passive\"" -l "Security Gateway High Availability Modus"

Security Management Status
/usr/lib/nagios/plugins/check_snmp -H $HOSTADDRESS$ -C $ARG1$ -o 1.3.6.1.4.1.2620.1.7.102.0 -s "\"OK\"" -l "Security Management Status"

Security Management Modus
/usr/lib/nagios/plugins/check_snmp -H $HOSTADDRESS$ -C $ARG1$ -o 1.3.6.1.4.1.2620.1.7.5.0 -s "\"active\"" -l "Security Management Modus"

If your monitoring system is using just simple SNMP queries, here are some OIDs to check for.

SVN Status – to be checked on every system

snmpget.exe -v 2c -c public 10.10.10.10 1.3.6.1.4.1.2620.1.6.102.0
SNMPv2-SMI::enterprises.2620.1.6.102.0 = STRING: "OK"
SNMPv2-SMI::enterprises.2620.1.6.102.0 = STRING: "Problem"

Security Gateway Policy Status

snmpget.exe -v 2c -c public 10.10.10.10 1.3.6.1.4.1.2620.1.1.1.0
SNMPv2-SMI::enterprises.2620.1.1.1.0 = STRING: "Installed"

Security Gateway HA Status

snmpget.exe -v 2c -c public 10.10.10.10 1.3.6.1.4.1.2620.1.5.102.0
SNMPv2-SMI::enterprises.2620.1.5.102.0 = STRING: "OK"

Security Gateway High Availability Mode

snmpget.exe -v 2c -c public 10.10.10.10 1.3.6.1.4.1.2620.1.5.6.0
SNMPv2-SMI::enterprises.2620.1.5.6.0 = STRING: "active"
SNMPv2-SMI::enterprises.2620.1.5.6.0 = STRING: "standby"

Security Management Status

snmpget.exe -v 2c -c public 10.10.10.10 1.3.6.1.4.1.2620.1.7.102.0
SNMPv2-SMI::enterprises.2620.1.7.102.0 = STRING: "OK"
SNMPv2-SMI::enterprises.2620.1.7.102.0 = STRING: "Problem"

Security Management Mode

snmpget.exe -v 2c -c public 10.10.10.10 1.3.6.1.4.1.2620.1.7.5.0
SNMPv2-SMI::enterprises.2620.1.7.5.0 = STRING: "active"

Tobias Lachmann

Checkpoint : Finding memory Leak

A memory leak, technically, is an ever-increasing usage of memory by an application.

With common desktop applications, this may go unnoticed, because a process typically frees any memory it has used when you close the application.

However, In the client/server model, memory leakage is a serious issue, because applications are expected to be available 24×7. Applications must not continue to increase their memory usage indefinitely, because this can cause serious issues. To monitor such memory leaks, we can use the following commands.
[Expert@splat]# ps -aux | sort -k5 -n | tail -5
Warning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.7/FAQ
root 30912 0.0 2.6 213348 55644 ? Sl 2011 0:07 in.aclientd 259
root 3783 0.0 2.6 213352 55544 ? Sl 2011 0:08 in.asessiond 0
root 30659 0.0 2.6 213436 55768 ? Sl 2011 0:08 in.ahclientd 900
root 3784 0.0 2.7 214356 56572 ? Sl 2011 0:09 in.aufpd 0
root 3504 0.0 3.1 414212 65168 ? Ssl 2011 24:32 fwd

In the above ps command, –sort option outputs the highest %MEM at bottom. Just note down the PID for the highest %MEM usage. Then use ps command to view all the details about this process id, and monitor the change over time. You had to manually repeat ir or put it as a cron to a file.

[Expert@splat1]# ps -ev 3504
Warning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.7/FAQ
PID TTY STAT TIME MAJFL TRS DRS RSS %MEM COMMAND
3504 ? Ssl 24:32 22 78 414133 65168 3.1 fwd PPKDIR=/opt/CPppak-R70 CPMDIR=/opt/CPsuite-R70/fw1 CONSOLE=/dev/console TERM=linux SUDIR=/opt/C

[Expert@splat1]# ps -ev 3504
Warning: bad syntax, perhaps a bogus '-'? See /usr/share/doc/procps-3.2.7/FAQ
PID TTY STAT TIME MAJFL TRS DRS RSS %MEM COMMAND
3504 ? Ssl 24:32 22 78 414133 65168 3.1 fwd PPKDIR=/opt/CPppak-R70 CPMDIR=/opt/CPsuite-R70/fw1 CONSOLE=/dev/console TERM=linux SUDIR=/opt/C

Note: In the above output, if RSS (resident set size, in KB) increases over time (so would %MEM), it may indicate a memory leak in the application.

Checkpoint : State Syncronization Guide

To reduce or eliminate these error messages verify that you followed the below recomendations:

• Sync network needs to be dedicated to synchronization only. It is not recommended to run VRRP or IPSO Cluster on sync interfaces (refer to sk39179).
• Sync interfaces should be configured as a non-ADP interfaces.
• Synchronization interfaces should be the same speed or faster than the fastest interface on the VRRP or IPSO Cluster. However, this recommendation is impractical when 10 gigabit interfaces are employed. In practice, no more than 2 gigabits of throughput is needed for sync traffic on IPSO Appliances. This means a pair of non-ADP gigabit Ethernet interfaces will be sufficient, though in many cases a single gigabit Ethernet interface will suffice.
• It is recommended to use a dedicated VLAN on a switch, for Check Point sync traffic from a single cluster only i.e. you should not mix CP sync traffic from other cluster members across this dedicated VLAN. Use of cross-over cable is also supported in a 2-node cluster. Choosing to use a switch or a cross-over cable for CP Sync traffic is a environment preference.
• For VRRP only - disable synchronization for certain services. This will help stabilize the systems because:
1. Less memory will be demanded by the sync process. You already saw some related messages in the fwd.elg about sync buffers being full.
2. This will release the CPU time.

The HTTP, HTTPS and DNS services are good candidates to be taken out of synchronization. Because of their nature, they are not affected on a fail over scenario without synchronization.

• The following limitations are applicable for state synchronization over wide area network:
1. The synchronization network must guarantee no more than 100ms latency and no more than 5% packet loss.
2. The synchronization network may only include switches and hubs. No routers are allowed on the synchronization network, because routers will drop Cluster Control Protocol (CCP) packets . CCP is either Multicast or Broadcast and thus non-routable.
• If IP cluster is configured between two IPSO Appliances located in two different cities, CCP and VRRP advertisements need to be update quite frequently. Any latency can cause both cluster members to behave abnormally. Also, if there is a break in the WAN link, both will become master, which can also cause problems.
  The solution is to ensure minimal latency between the cluster members and a highly reliable link.

Checkpoint - IPSO - Memory Usage

In Voyager Monitor option select CPU and Memory Utilization . This gives you the Total Real Memory, Active Real Memory and the Free Memory available on the appliance.

For console access use clish to display the Real Memory Used. This value is displayed in terms of percentage value.

ipso[admin]# clish

clish:1> show useful-stats



Components Total

Active Routes 4

Packets Forwarded 0

VRRP Masters 0

Real Memory Used 22%

Disk Capacity 11%

Note: The real physical memory output gathered from Voyager is taken from the kernel directly.