Check Point : Provider-1 / Smart Center Sever - Connected Admins

After a long time, I got something to post; Something which I lost in-transit...

How to check any connected admins from CLI of a Provider-1 or a SmartCenter Server

It is very simple, 


Provider-1
==========

[Expert@Provider-1]# mdsenv 192.168.1.100
[Expert@Provider-1]# cpstat mg

Product Name:  Check Point SmartCenter Server
Major version: 6
Minor version: 0
Build number:  730640034
Is started:    1
Active status: active
Status:        OK


Connected clients
----------------------------------------------------------
|Client type   |Administrator|Host         |Database lock|
----------------------------------------------------------
|SmartDashboard|admin    |TRE-3SPENCERA|false        |
----------------------------------------------------------

Smart Center Server
==================

[Expert@SCS]# cpstat mg

Product Name:  Check Point SmartCenter Server
Major version: 6
Minor version: 0
Build number:  730640034
Is started:    1
Active status: active
Status:        OK


Connected clients
----------------------------------------------------------
|Client type   |Administrator|Host         |Database lock|
----------------------------------------------------------
|SmartDashboard|admin    |TRE-3SPENCERA|false        |
----------------------------------------------------------

FTP : Syntax and Examples

List of FTP commands for the Microsoft command-line FTP client

Command-line options

As you're starting the program from a DOS prompt:
ftp [-v] [-d] [-i] [-n] [-g] [-s:filename] [-a] [-w:windowsize] [computer]

• -v - Suppresses verbose display of remote server responses.
• -n - Suppresses auto-login upon initial connection.
• -i - Turns off interactive prompting during multiple file transfers.
• -d - Enables debugging, displaying all ftp commands passed between the client and server.
• -g - Disables filename globbing, which permits the use of wildcard chracters in local file and path names.
• -s:filename - Specifies a text file containing ftp commands; the commands will automatically run after ftp starts. No spaces are allowed in this parameter. Use this switch instead of redirection (>).
• -a - Use any local interface when binding data connection.
• -w:windowsize - Overrides the default transfer buffer size of 4096.
• computer - Specifies the computer name or IP address of the remote computer to connect to. The computer, if specified, must be the last parameter on the line.

Client commands

• ! - Runs the specified command on the local computer
• ? - Displays descriptions for ftp commands
• append - Appends a local file to a file on the remote computer
• ascii - Sets the file transfer type to ASCII, the default
• bell - Toggles a bell to ring after each file transfer command is completed (default = OFF)
• binary - Sets the file transfer type to binary
• bye - Ends the FTP session and exits ftp
• cd - Changes the working directory on the remote computer
• close - Ends the FTP session and returns to the command interpreter
• debug - Toggles debugging (default = OFF)
• delete - Deletes a single file on a remote computer
• dir - Displays a list of a remote directory's files and subdirectories
• disconnect - Disconnects from the remote computer, retaining the ftp prompt
• get - Copies a single remote file to the local computer
• glob - Toggles filename globbing (wildcard characters) (default = ON)
• hash - Toggles hash-sign (#) printing for each data block transferred (default = OFF)
• help - Displays descriptions for ftp commands
• lcd - Changes the working directory on the local computer
• literal - Sends arguments, verbatim, to the remote FTP server
• ls - Displays an abbreviated list of a remote directory's files and subdirectories
• mdelete - Deletes one or more files on a remote computer
• mdir - Displays a list of a remote directory's files and subdirectories
• mget - Copies one or more remote files to the local computer
• mkdir - Creates a remote directory
• mls - Displays an abbreviated list of a remote directory's files and subdirectories
• mput - Copies one or more local files to the remote computer
• open - Connects to the specified FTP server
• prompt - Toggles prompting (default = ON)
• put - Copies a single local file to the remote computer
• pwd - Displays the current directory on the remote computer (literally, "print working directory")
• quit - Ends the FTP session with the remote computer and exits ftp (same as "bye")
• quote - Sends arguments, verbatim, to the remote FTP server (same as "literal")
• recv - Copies a remote file to the local computer
• remotehelp - Displays help for remote commands
• rename - Renames remote files
• rmdir - Deletes a remote directory
• send - Copies a local file to the remote computer (same as "put")
• status - Displays the current status of FTP connections
• trace - Toggles packet tracing (default = OFF)
• type - Sets or displays the file transfer type (default = ASCII)
• user - Specifes a user to the remote computer
• verbose - Toggles verbose mode (default = ON)

---

!

Runs the specified command on the local computer. Syntax: ! [command]
Parameter(s):
command - Specifies the command to run on the local computer. If command is omitted, the local command prompt is displayed; type "exit" to return to ftp.

?

Displays descriptions for ftp commands. ? is identical to help. Syntax: ? [command]
Parameter(s):
command - Specifies the name of the command about which you want a description. If command is not specified, ftp displays a list of all commands.

append

Appends a local file to a file on the remote computer using the current file type setting. Syntax: append local-file [remote-file]
Parameter(s):
local-file - Specifies the local file to add.
remote-file - Specifies the file on the remote computer to which local-file will be added. If remote-file is omitted, the local filename is used for the remote filename.

ascii

Sets the file transfer type to ASCII, the default. Syntax: ascii
Note
FTP supports two file transfer types, ASCII and binary image. ASCII should be used when transferring text files. See also binary.
In ASCII mode, character conversions to and from the network standard character set are performed. For example, end-of-line characters are converted as necessary, based on the target operating system.

bell

Toggles a bell to ring after each file transfer command is completed. By default, the bell is off. Syntax: bell

binary

Sets the file transfer type to binary. Syntax: binary
Note
FTP supports two file transfer types, ASCII and binary image. Binary should be used when transferring executable files. In binary mode, the file is moved byte-by-byte. See also ascii.

bye

Ends the FTP session with the remote computer and exits ftp. Syntax: bye

cd

Changes the working directory on the remote computer. Syntax: cd remote-directory
Parameter(s):
remote-directory - Specifies the directory on the remote computer to change to.

close

Ends the FTP session with the remote server and returns to the command interpreter. Syntax: close

debug

Toggles debugging. When debugging is on, each command sent to the remote computer is printed, preceded by the string --->. By default, debugging is off. Syntax: debug

delete

Deletes a single file on a remote computer. See also mdelete, which can delete multiple files. Syntax: delete remote-file
Parameter(s):
remote-file - Specifies the file to delete.

dir

Displays a list of a remote directory's files and subdirectories. See also mdir, which can list multiple directories. Syntax: dir [remote-directory] [local-file]
Parameter(s):
remote-directory - Specifies the directory for which you want to see a listing. If no directory is specified, the current working directory on the remote computer is used.
local-file - Specifies a local file to store the listing. If not specified, output is displayed on the screen.

disconnect

Disconnects from the remote computer, retaining the ftp prompt. Syntax: disconnect

get

Copies a remote file to the local computer using the current file transfer type. See also mget, which can copy multiple files. Syntax: get remote-file [local-file]
Parameter(s):
remote-file
Specifies the remote file to copy.
local-file
Specifies the name to use on the local computer. If not specified, the file is given the remote-file name.

glob

Toggles filename globbing. Globbing permits use of wildcard characters in local file or path names. By default, globbing is on. Syntax: glob

hash

Toggles hash-sign (#) printing for each data block transferred. The size of a data block is 2048 bytes. By default, hash mark printing is off. Syntax: hash

help

Displays descriptions for ftp commands. Syntax: help [command]
Parameter(s):
command - Specifies the name of the command about which you want a description. If command is not specified, ftp displays a list of all commands.

lcd

Changes the working directory on the local computer. By default, the working directory is the directory in which ftp was started. Syntax: lcd [directory]
Parameter(s):
directory - Specifies the directory on the local computer to change to. If directory is not specified, the current working directory on the local computer is displayed.

literal

Sends arguments, verbatim, to the remote FTP server. A single FTP reply code is expected in return. Syntax: literal argument [ ...]
Parameter(s):
argument - Specifies the argument to send to the FTP server.

ls

Displays an abbreviated list of a remote directory's files and subdirectories. Syntax: ls [remote-directory] [local-file]
Parameter(s):
remote-directory - Specifies the directory for which you want to see a listing. If no directory is specified, the current working directory on the remote computer is used.
local-file - Specifies a local file to store the listing. If not specified, output is displayed on the screen.

mdelete

Deletes one or more files on a remote computer. Syntax: mdelete remote-files [ ...]
Parameter(s):
remote-files - Specifies the remote files to delete.

mdir

Displays a list of a remote directory's files and subdirectories. Mdir allows you to specify multiple files. Syntax: mdir remote-files [ ...] local-file
Parameter(s):
remote-files - Specifies the directory for which you want to see a listing. Remote-files must be specified; type "-" to use the current working directory on the remote computer.
local-file - Specifies a local file to store the listing. Type "-" to display the listing on the screen.

mget

Copies one or more remote files to the local computer using the current file transfer type. Syntax: mget remote-files [ ...]
Parameter(s):
remote-files - Specifies the remote file(s) to copy to the local computer.

mkdir

Creates a remote directory. Syntax: mkdir directory
Parameter(s):
directory - Specifies the name of the new remote directory.

mls

Displays an abbreviated list of a remote directory's files and subdirectories. Syntax: mls remote-files [ ...] local-file
Parameter(s):
remote-files - Specifies the files for which you want to see a listing. Remote-files must be specified; type "-" to use the current working directory on the remote computer.
local-file - Specifies a local file to store the listing. Type "-" to display the listing on the screen.

mput

Copies one or more local files to the remote computer using the current file transfer type. Syntax: mput local-files [ ...]
Parameter(s):
local-files - Specifies the local files to copy to the remote computer.

open

Connects to the specified FTP server. Syntax: open computer [port]
Parameter(s):
computer - Specifies the remote computer to connect to. Computer can be specified by IP address or computer name (a DNS or HOSTS file must be available). If auto-login is on (default), FTP also attempts to automatically log the user in to the FTP server (see Ftp command-line options to disable auto-login).
port - Specifies a port number to use to contact an FTP server.

prompt

Toggles prompting. Ftp prompts during multiple file transfers to allow you to selectively retrieve or store files; mget and mput transfer all files if prompting is turned off. By default, prompting is on. Syntax: prompt

put

Copies a local file to the remote computer using the current file transfer type. See also mput, which can copy multiple files. Syntax: put local-file [remote-file]
Parameter(s):
local-file - Specifies the local file to copy.
remote-file - Specifies the name to use on the remote computer. If not specified, the file is given the local-file name.

pwd

Displays the current directory on the remote computer. Syntax: pwd

quit

Ends the FTP session with the remote computer and exits ftp. Syntax: quit

quote

Sends arguments, verbatim, to the remote FTP server. A single FTP reply code is expected in return. Quote is identical to literal. Syntax: quote argument [ ...]
Parameter(s):
argument - Specifies the argument to send to the FTP server.

recv

Copies a remote file to the local computer using the current file transfer type. Recv is identical to get. Syntax: recv remote-file [local-file]
Parameter(s):
remote-file - Specifies the remote file to copy.
local-file - Specifies the name to use on the local computer. If not specified, the file is given the remote-file name.

remotehelp

Displays help for remote commands. Syntax: remotehelp [command]
Parameter(s):
command - Specifies the name of the command about which you want help. If command is not specified, ftp displays a list of all remote commands.

rename

Renames remote files. Syntax: rename filename newfilename
Parameter(s):
filename - Specifies the file you want to rename.
newfilename - Specifies the new filename.

rmdir

Deletes a remote directory. Syntax: rmdir directory
Parameter(s):
directory - Specifies the name of the remote directory to delete.

send

Copies a local file to the remote computer using the current file transfer type. Send is identical to put. Syntax: send local-file [remote-file]
Parameter(s):
local-file - Specifies the local file to copy.
remote-file - Specifies the name to use on the remote computer. If not specified, the file is given the local-file name.

status

Displays the current status of FTP connections and toggles. Syntax: status

trace

Toggles packet tracing; trace displays the route of each packet when running an ftp command. Syntax: trace

type

Sets or displays the file transfer type. Syntax: type [type-name]
Parameter(s):
type-name - Specifies the file transfer type; the default is ASCII. If type-name is not specified, the current type is displayed.
Note
FTP supports two file transfer types, ASCII and binary image.
ASCII should be used when transferring text files. In ASCII mode, character conversions to and from the network standard character set are performed. For example, end-of-line characters are converted as necessary, based on the destination's operating system.
Binary should be used when transferring executable files. In binary mode, the file is moved byte-by-byte.

user

Specifes a user to the remote computer. Syntax: user user-name [password] [account]
Parameter(s):
user-name - Specifies a user name with which to log in to the remote computer.
password - Specifies the password for user-name. If not specified, but required, ftp prompts for the password.
account - Specifies an account with which to log on to the remote computer. If account is not specified, but required, ftp prompts for the account.

verbose

Toggles verbose mode. If on, all ftp responses are displayed; when a file transfer completes, statistics regarding the efficiency of the transfer are also displayed. By default, verbose is on. Syntax: verbose

Windows : Here is a list of commands that you can run off from the Run Command Prompt

Here is a list of commands that you can run off from the Run Command Prompt:

============================================================================

Program Run Command

Accessibility Controls = access.cpl

Accessibility Wizard = accwiz

Add Hardware Wizard = hdwwiz.cpl

Add/Remove Programs = appwiz.cpl

Administrative Tools = control admintools

Adobe Acrobat ( if installed ) = acrobat

Adobe Distiller ( if installed ) = acrodist

Adobe ImageReady ( if installed ) = imageready

Adobe Photoshop ( if installed ) = photoshop

Automatic Updates = wuaucpl.cpl

Basic Media Player = mplay32

Bluetooth Transfer Wizard = fsquirt

Calculator = calc

Ccleaner ( if installed ) = ccleaner

C: Drive = c:

Certificate Manager = cdrtmgr.msc

Character Map = charmap

Check Disk Utility = chkdsk

Clipboard Viewer = clipbrd

Command Prompt = cmd

Command Prompt = command

Component Services = dcomcnfg

Computer Management = compmgmt.msc

Compare Files = comp

Control Panel = control

Create a shared folder Wizard = shrpubw

Date and Time Properties = timedate.cpl

DDE Shares = ddeshare

Device Manager = devmgmt.msc

Direct X Control Panel ( if installed ) = directx.cpl

Direct X Troubleshooter = dxdiag

Disk Cleanup Utility = cleanmgr

Disk Defragment = dfrg.msc

Disk Partition Manager = diskmgmt.msc

Display Properties = control desktop

Display Properties = desk.cpl

Display Properties (w/Appearance Tab Preselected ) = control color

Dr. Watson System Troubleshooting Utility = drwtsn32

Driver Verifier Utility = verifier

Ethereal ( if installed ) = ethereal

Event Viewer = eventvwr.msc

Files and Settings Transfer Tool = migwiz

File Signature Verification Tool = sigverif

Findfast = findfast.cpl

Firefox = firefox

Folders Properties = control folders

Fonts = fonts

Fonts Folder = fonts

Free Cell Card Game = freecell

Game Controllers = joy.cpl

Group Policy Editor ( xp pro ) = gpedit.msc

Hearts Card Game = mshearts

Help and Support = helpctr

Hyperterminal = hypertrm

Hotline Client = hotlineclient

Iexpress Wizard = iexpress

Indexing Service = ciadv.msc

Internet Connection Wizard = icwonn1

Internet Properties = inetcpl.cpl

Internet Setup Wizard = inetwiz

IP Configuration (Display Connection Configuration) = ipconfig /all

IP Configuration (Display DNS Cache Contents) = ipconfig /displaydns

IP Configuration (Delete DNS Cache Contents) = ipconfig /flushdns

IP Configuration (Release All Connections) = ipconfig /release

IP Configuration (Renew All Connections) = ipconfig /renew

IP Configuration (Refreshes DHCP & Re-Registers DNS) = ipconfig /registerdns

IP Configuration (Display DHCP Class ID) = ipconfig /showclassid

IP Configuration (Modifies DHCP Class ID) = ipconfig /setclassid

Java Control Panel ( if installed ) = jpicpl32.cpl

Java Control Panel ( if installed ) = javaws

Keyboard Properties = control keyboard

Local Security Settings = secpol.msc

Local Users and Groups = lusrmgr.msc

Logs You Out of Windows = logoff

Malicious Software Removal Tool = mrt

Microsoft Access ( if installed ) = access.cpl

Microsoft Chat = winchat

Microsoft Excel ( if installed ) = excel

Microsoft Diskpart = diskpart

Microsoft Frontpage ( if installed ) = frontpg

Microsoft Movie Maker = moviemk

Microsoft Management Console = mmc

Microsoft Narrator = narrator

Microsoft Paint = mspaint

Microsoft Powerpoint = powerpnt

Microsoft Word ( if installed ) = winword

Microsoft Syncronization Tool = mobsync

Minesweeper Game = winmine

Mouse Properties = control mouse

Mouse Properties = main.cpl

MS-Dos Editor = edit

MS-Dos FTP = ftp

Nero ( if installed ) = nero

Netmeeting = conf

Network Connections = control netconnections

Network Connections = ncpa.cpl

Network Setup Wizard = netsetup.cpl

Notepad = notepad

Nview Desktop Manager ( if installed ) = nvtuicpl.cpl

Object Packager = packager

ODBC Data Source Administrator = odbccp32

ODBC Data Source Administrator = odbccp32.cpl

On Screen Keyboard = osk

Opens AC3 Filter ( if installed ) = ac3filter.cpl

Outlook Express = msimn

Paint = pbrush

Password Properties = password.cpl

Performance Monitor = perfmon.msc

Performance Monitor = perfmon

Phone and Modem Options = telephon.cpl

Phone Dialer = dialer

Pinball Game = pinball

Power Configuration = powercfg.cpl

Printers and Faxes = control printers

Printers Folder = printers

Private Characters Editor = eudcedit

Quicktime ( if installed ) = quicktime.cpl

Quicktime Player ( if installed ) = quicktimeplayer

Real Player ( if installed ) = realplay

Regional Settings = intl.cpl

Registry Editor = regedit

Registry Editor = regedit32

Remote Access Phonebook = rasphone

Remote Desktop = mstsc

Removable Storage = ntmsmgr.msc

Removable Storage Operator Requests = ntmsoprq.msc

Resultant Set of Policy ( xp pro ) = rsop.msc

Scanners and Cameras = sticpl.cpl

Scheduled Tasks = control schedtasks

Security Center = wscui.cpl

Services = services.msc

Shared Folders = fsmgmt.msc

Sharing Session = rtcshare

Shuts Down Windows = shutdown

Sounds Recorder = sndrec32

Sounds and Audio = mmsys.cpl

Spider Solitare Card Game = spider

SQL Client Configuration = clicongf

System Configuration Editor = sysedit

System Configuration Utility = msconfig

System File Checker Utility ( Scan Immediately ) = sfc /scannow

System File Checker Utility ( Scan Once At Next Boot ) = sfc /scanonce

System File Checker Utility ( Scan On Every Boot ) = sfc /scanboot

System File Checker Utility ( Return to Default Settings) = sfc /revert

System File Checker Utility ( Purge File Cache ) = sfc /purgecache

System File Checker Utility ( Set Cache Size to Size x ) = sfc /cachesize=x

System Information = msinfo32

System Properties = sysdm.cpl

Task Manager = taskmgr

TCP Tester = tcptest

Telnet Client = telnet

Tweak UI ( if installed ) = tweakui

User Account Management = nusrmgr.cpl

Utility Manager = utilman

Volume Serial Number for C: = label

Volume Control = sndvol32

Windows Address Book = wab

Windows Address Book Import Utility = wabmig

Windows Backup Utility ( if installed ) = ntbackup

Windows Explorer = explorer

Windows Firewall = firewall.cpl

Windows Installer Details = msiexec

Windows Magnifier = magnify

Windows Management Infrastructure = wmimgmt.msc

Windows Media Player = wmplayer

Windows Messenger = msnsgs

Windows Picture Import Wizard (Need camera connected) = wiaacmgr

Windows System Security Tool = syskey

Windows Script host settings = wscript

Widnows Update Launches = wupdmgr

Windows Version ( shows your windows version ) = winver

Windows XP Tour Wizard = tourstart

Wordpad = write

Zoom Utility = igfxzoom

If you found this list of Run Commands useful, please Like and Share to Everyone.!

Migration from SecurePlatform to Gaia

Solution ID: sk68140 Product: Security Gateway, Security Management, SecurePlatform Version: R75.40 OS: Gaia Platform / Model: All

Solution 

This solution describes a method for performing a migration from SecurePlatform to Gaia.
For example, when you want to replicate machine A (running SecurePlatform) onto machine B (running Gaia).

Important: The process described in this page handles operating system configuration only. Security Gateway migration is a different process, which is not discussed in this page.

Steps

1. Export the SecurePlatform configuration into a tarball.
2. Copy the tarball into the Gaia machine and extract the files.
3. Run the Gaia converter on the SecurePlatform configuration files, to generate a clish script.
4. Load the clish script into Gaia.

Step 1 - Export SecurePlatform configuration

You can do it in two ways:

1. The recommended way is copying the configuration files directly, because it does not involve a cpstop and can be run on a production machine. You can use the copyfiles script to copy the files to a tarball.
2. Get the files is through backup of SecurePlatform. This involves stopping the firewall (cpstop).

Step 2 - Copy the file into the Gaia machine

Copy the files from Step 1 into the Gaia machine, and put them in a directory.

Step 3 - Run the Gaia converter

Run the converter utility in the same directory where you put the SecurePlatform configuration files.

Example:

clish> expert

Enter expert password:

bash> converter -o myconfig

The resulting myconfig script contains clish commands that can be run in Gaia to replicate the same OS configuration.

Step 4 - Load the clish script

There are two ways to do it:

1. The recommended way is to put the clish script in your home directory, and then run the following four commands:
   
   clish> set clienv on-failure continue
   clish> load configuration myconfig
   clish> set clienv on-failure stop
   clish> save config 

1. Run the clish with a script like this:
   bash> clish -fi myconfig
   bash> clish -c "save config"

Note: The following files are processed by the Gaia converter.

Feature	File name
Interfaces and routing	/etc/sysconfig/netconf.C
	/etc/sysconfig/network
Known hosts	/etc/hosts
	/etc/hosts.allow
Passwords	/etc/shadow
User accounts	/etc/passwd
Known DNS servers	/etc/resolv.conf
	/etc/sysconfig/external.if
DHCP client	/etc/dhcpd.conf
DHCP server	/etc/sysconfig/dhcpd
DHCP relay	/etc/sysconfig/dhcrelay
Cron jobs	/var/spool/cron/root
NTP client	/etc/sysconfig/ntp
	/opt/spwm/conf/cp_http_admin_server.conf
Known RADIUS servers	/etc/raddb/server
RADIUS groups	/etc/raddb/groups
	/etc/sysconfig/ethtab
Syslog	/etc/sysconfig/syslog
Syslog	/etc/syslog.conf
ARP dynamic cache size	/proc/sys/net/ipv4/neigh/default/gc_thresh3

Checkpoint : SecureXL

Traffic acceleration When SecureXL is enabled, all traffic should be accelerated, except traffic that matches the following conditions: The first packets of any new TCP session, unless a "template" exists. The first packet of any new UDP session. All traffic that matches a service that uses a Resource. Certain traffic that matches a service that is inspected by a SmartDefence or Web Intelligence feature. For example, traffic on which SSH protections are activated is not accelerated. For more details, refer to sk42401: Factors that adversely affect performance in SecureXL. All traffic that is supposed to be dropped or rejected, according to the rule base. All traffic that matches a rule, whose source or destination is the Gateway itself. All traffic that matches a rule with a Security Server. All traffic that matches a rule with User Authentication or Session Authentication. Non-TCP/UDP/GRE/ESP traffic. All multicast traffic. All fragmented traffic. All traffic with IP options. RST packets, when the "Spoofed Reset Protection" feature is activated. When using ClusterXL in Load Sharing mode with 'Sticky Decision Function'. Traffic that violates stateful inspection paradigm, or that is suspected to be spoofed. IPv6 traffic Connection establishment acceleration ("templates" mechanism) In order to enhance connection establishment acceleration, a mechanism attempts to "group together" all connections that match a particular service and whose sole discriminating element is the Source Port. This type of "grouping" enables even the very first packets of a TCP handshake to be accelerated. This is very useful on short connections, in which the percentage of TCP handshake traffic is very high. The very first packets of the first connection on the same service will be forwarded to the Security Gateway's kernel, which will then create a "template" of the connection and notify the SecureXL device. Any subsequent TCP establishments on the same service (where only the source port is different) will already be accelerated (as well as any other traffic, of course). There are several conditions that will prevent a template from being created: Connections that cannot be discriminated ONLY by the source port cannot be templated. NATed traffic cannot be templated. VPN traffic cannot be templated. Complex connections (FTP, H323, etc.) cannot be templated. Non-TCP/Non-UDP traffic cannot be templated. The following rules will prevent a Connection Template from being created. All subsequent rules below such rules will not be templated as well, regardless of the rule. It is advised that all rules that can be templated, be placed at the top of the rule base (unless of course, this will violate other optimization considerations): Rule with service 'Any' Rule with a service that has a 'handler' (where a specific protocol is chosen in 'Protocol Type' field - instead of 'None' ; go to service object - right-click - Edit... - Advanced... - Protocol Type:). Rules with the following objects: Time object Port range object Dynamic object Rules with "complex" services (i.e., services that have anything specified in the "Match" field, or "Enable reply from any port" of their "Advanced" section or Source Port is defined). Rules with RPC/DCOM/DCE-RPC services. Rules with Client Authentication or Session Authentication. When SYN Defender or Small PMTU features are activated in SmartDefense/IPS.

/var/log/messages interpretation

/var/log/messages interpretation:
======================

Jun 10 01:48:15 FW00301 sshd(pam_unix)[2833]: session opened for user admin by (uid=0)

Jun 10 01:48:18 FW00301 cpshell: cmd by admin:  ifconfig -a

Jun 10 01:48:19 FW00301 cpshell: cmd by admin:  fw stat

Jun 10 01:48:19 FW00301 shell: cmd by admin: uptime

Jun 10 01:48:38 FW00301 shell: cmd by admin: cphaprob state

Jun 10 01:48:43 FW00301 cpshell: cmd by admin:  uptime

Jun 10 01:48:45 FW00301 cpshell: cmd by admin:  time

Jun 10 01:48:48 FW00301 cpshell: cmd by admin:  ver

Jun 10 01:48:49 FW00301 cpshell: cmd by admin:  uptime

Jun 10 01:48:52 FW00301 cpshell: cmd by admin:  fw ver

Jun 10 01:48:56 FW00301 shell: cmd by admin: cat /var/log/messages

In Above example. You can see the logs of command execution form admin othru cpshell and shell


Here is the explanation,

Shell - ILO user thru VSP

CPShell - User thru CLI - vty (putty in my case)

NIC status in Linux

#!/bin/bash

NICLIST=`ifconfig | egrep '^eth[0-9] ' | awk '{ print $1 }'`


for nics in $NICLIST
do
niclink=(`ethtool $nics | awk '/Duplex/ { duplex=$2 }; /Link detected/ { link=$3 }; /Speed/ { speed=$2 } END { print link " " speed " " duplex }'`)

if [ "${niclink[0]}" = "yes" ]; then
speed="${niclink[1]}"
duplex="${niclink[2]}"
fi

printf "%7s %4s %9s %5s\n" $nics ${niclink[0]} $speed $duplex


speed=""
duplex=""
done


Note : Power-1 and UTM-1 There are differences as the nic name changes