This is a short list of Checkpoint VSX Commands that I am compiling as I continue to work with CheckPoint VSX systems. The list is not comprehensive and may not work for everyone, so if you see errors, please contact me so I may correct them. Thanks! /ryan Check Point CLI "CP" Commands CLI Command Command Description vsx get View current shell context. vsx set Set context to VS with the ID . [Expert@FW-VSX-Gateway:0]# vsx set 3 Context is set to Virtual Device … [Read more...]
Check Point Quick Reference – Tcpdump
NOTE: fw monitor operates above layer 2 and does not include mac address information - cant see ARP messages. tcpdump can see layer 2 ARP messages This is one of the most common tcpdump commands: (looks for packets from a src to dst, need to specify interface) tcpdump nn-i eth2 host 11.11.11.11 and host 22.22.22.22 08:02:15.043273 11.11.11.11.62044 > 22.22.22.22.https: S 1943270491:1943270491(0) win 65535 tcpdump -nni eth0 tcpdump -nni eth0 host 111.111.111.111 tcpdump -nni eth0 … [Read more...]
Check Point Quick Reference – FW Monitor
Overview: FW Monitor is a built-in firewall tool which needs no separate install on the device you wish to capture packets and interrogate connections. It is a functionality provided with the installation of the FW-1 package and syntax is also identical across all FW-1 installations. FW Monitor allows for sampling the connection from 4 different points in the firewall, can show NAT assignments or see if routing is working right. FW Monitor happens at the kernel level, but is not a packet … [Read more...]
Firewall Commands For Identifying Specific Routes
The Question: Using firewall commands, identify the route to specific destination/target without using the routing table (more specific) I was asked the question today, and blanked out... I have ran the Cisco and CheckPoint IPSO versions, but not Splat and still couldn't pull it from memory. Once I looked it up I felt silly, but knew it will be a good addition to my little knowledge repository. CheckPoint - IPSO: show route destination xx.xx.xx.xx Checkpoint - Splat: ip route get … [Read more...]
CheckPoint SmartDashboard – Missing Menu
Hello All. I was bouncing around in the Checkpoint SmartDashboard, updating rules in some firewalls and noticed that the menu bar at the top of the window was missing... After some searching, I found that a registry setting needed to be modified to restore the SmartDashboard menu bar. Here is the registry path that needed to be modified: HKEY_CURRENT_USER\Software\CheckPoint\Management Clients\6.2.01\R75.10\Check Point SmartDashboard\Check Point SmartDashboard\Toolbar … [Read more...]
Check Point Firewall – Nokia IPSO CST Hanging or Taking Forever?
Is your Nokia IPSO CST Not finishing? Trying to run a CST on your Nokia, but seems to be taking forever? I have had the same issue on various Nokia security appliances running on IPSO 4.2 and older. The problem ended up being hung process that was spawned by the CST program. It seems that CST calls "fw tab -u -t", and sometimes it just gets hung up, but will look to the user like the whole CST process is just hung. Here is a sample so you can get a visual: FIREWALL123[admin]# cst IPSO … [Read more...]
Check Point Firewall – Detect SSH over Non Standard Ports
Many enterprises deploy proxies these days, but many are not aware that if they are not configured correctly they may be allowing SSH over Non Standard Ports, giving a tech savvy employee the keys to exploit this fault. Most times this is SSH over HTTP/HTTPS, but can also be over other ports, which is less common. Blue Coat proxies detect and drop this type of activity by default, but like I said, all it takes is a few small lines of CPL to override this default blocking (CPL is left out … [Read more...]
Check Point Firewall – Interfaces Reordered Upon Upgrade
A few days ago, one of our Check Point IAS M6 Firefly equiped, R70.20 Splat clusters, had a member fail due to "PLANAR VOLTAGE FAILURE", so says the IBM iLO event log. Since this is not solved by a simple power supply replacement, so an RMA replacement unit from Check Point was obtained. The new device came pre-loaded with R65 and no HFA's or hotfixes. So we distributed R70 Splat to the box via Provider-1, upgraded and everything was happy, with us seemingly cruising along on a smooth … [Read more...]
Check Point Firewall – Backup vs Snapshot
Backup procedures Check Point provides three different procedures for backing up (and restoring) the operating system and networking parameters on your appliances. • Snapshot (Revert) • Backup (Restore) • upgrade_export Each of these procedures backs up certain parameters and has relative advantages (such as: file size, speed, and portability), which are fully described in this article, together with detailed instructions as to how to carry out each procedure. Snapshot The snapshot … [Read more...]
Check Point Firewall – SPLAT CLI Commands
Here is a list of SPLAT CLI Commands commands for Checkpoint Secure Platform, that I have compiled from my studies, checkpoint documents, and places around the web. This is by no means an exhaustive or comprehensive list, but is rather meant to be a command line KB of sorts - mainly for my quick reference. The list is split into CP and FW commands. If the list proves useful to you, please feel free to share the link with others. Also, if you see any typo's with anything, feel free to let me … [Read more...]