How to enable/Activate Checkpoint SmartLog in R76 and above

1. Open your SmartDashboard, double click on Management Server Object.
2. Make sure in General Properties  Logging & Status should be checked.

3. Go to Log and Check Enable SmartLog option.

4. Go to Storage and Set the number of days to keep Indexing.

5. Then click on OK and Install the Policy on all the Security Gateways which are supposed to send logs to this Log Server.

Configuring the Start date/time for logs indexing

1.  Login to your management server CLI console with expert level permission.
2.  Run the command:
[Expert@HostName]# cp $SMARTLOGDIR/smartlog_settings.txt $SMARTLOGDIR/smartlog_settings.txt_ORIGINAL

3.  Run the command:
[Expert@HostName]# vi $SMARTLOGDIR/smartlog_settings.txt

4.  Delete these lines:
time_restriction_for_fetch_all (<existing_data>)
time_restriction_for_fetch_all_disp (<existing_data>)

5.  Save and exit from VI editor
6.  Backup and edit $SMARTLOGDIR/conf/smartlog_settings.conf and change the number of days of logs to re-index:
[Expert@HostName]# cp $SMARTLOGDIR/conf/smartlog_settings.conf $SMARTLOGDIR/conf/smartlog_settings.conf_ORIGINAL
[Expert@HostName]# vi $SMARTLOGDIR/conf/smartlog_settings.conf

:num_days_restriction_for_fetch_all_integrated (<days>)

<days> is the last number of days of logs to be indexed by the SmartLog server. For example, to re-index logs from the last 365 days of logs, give a value of 365.

Note: - To reduce the performance impact while re-indexing, Checkpoint recommend that you only the number of days of logs that you need.

7.  Backup and remve $SMARTLOGDIR/data/FetchedFiles
[Expert@HostName]# cp $SMARTLOGDIR/data/FetchedFiles $SMARTLOGDIR/data/FetchedFiles_ORIGINAL
[Expert@HostName]# rm -i $SMARTLOGDIR/data/FetchedFiles

8.  Restart SmartLog services:
[Expert@HostName]# smartlogstop
[Expert@HostName]# smartlogstart

9.  Verify smartlog_settings.txt shows the earliest date of re-index
[Expert@HostName]# grep restriction $SMARTLOGDIR/smartlog_settings.txt

10. Login to SmartLog and check the logs there.

(Note: It is possible when you first time open the SmartLog you will not be able to see all the past days logs, it is due to Indexing time. Indexing takes time depending on the number days and volume of logs in each log file need to be indexed).

11. If you wish to check which file has been already indexed during indexing, use this command:
[Expert@HostName]# cat /var/log/opt/CPSmartLog-RXX/data/FetchedFiles

(Note: in CPSmartLog-RXX, RXX is version of Checkpoint e.g. R77)

12. That's it.

How to add Proxy ARP in Checkpoint local.arp file?

The best way to add a proxy arp is as follows:

1) Login to the gateway(s) that requires the proxy arp.
2) Use the following command to add an arp to the local.arp file. This will append new arps for you without having to use Vi.

echo “192.168.1.2 AA:BB:CC:DD:EE” >> $FWDIR/conf/local.arp

Make sure that the mac address you use is from the physical gateway. For instance in a HA Active/Standy cluster xl setup you will need to use the MAC from each clusters’ interface respectively.

Push the policy after you add the arps.

You only need a route for the NAT address if you dont have “translate destination on client side enabled”

How to change the Keyboard-layout in Checkpoint running on SPLAT

edit the /etc/sysconfig/keyboard file, for standard US keyboard, it should look like this:

KEYBOARDTYPE="pc"
KEYTABLE="us"

Note: If the file doesn't exist it can be created

Migrate Check Point Security Management Server to New Hardware

When upgrading Check Point Security Management Server aka Smartcenter to a newer version I prefer to perform a fresh install and migrate the existing database to new hardware. Refer to the Check Point upgrade map here for valid upgrade paths. In my scenario I was running R71.20 on SecurePlatform (SPLAT) and was only able to directly upgrade R75, the procedure below describes the steps performed. Perform these steps in a lab environment to fully test and understand the procedure.

Upgrade the migration tools on the old server

Before exporting the database, the upgrade tools on the existing server need to be upgraded to the version being migrated to.

1. Download the “Management Server Migration Tools” for R75 from the Check Point website.
   
2. Extract the contents of “Management Server Migration Tools” .tgz
   
3. Use SCP and copy the contents and replace the upgrade_tools directory on the existing R71.20 server /opt/CPSuite-R71.20/fw1/bin/upgrade_tools 
    
   

Create a management database export file on the existing server

1. Login to expert mode on the existing server
   
2. Type “cd $FWDIR/bin/upgrade_tools
   

3. Run the migrate export command
   

   “./migrate export –l <EXPORTED DATABASE NAME>.tgz”

Once the export has been complete use SCP to copy the export file to a safe location.

Import the database to the new Security Management Server

1. From a client machine connect copy the backup database file to the new server via SCP. For simplicity I copy the database export to the same location as the upgrade tools ($FWDIR/bin/upgrade_tools)
   

1. Login to expert mode on the new server
   
2. Type “cd $FWDIR/bin/upgrade_tools
   
3. Type “./migrate import BACKUPFILENAME.tgz
   

1. When prompted to stop all Check Point services, type “Y” – ENTER
   
2. Once the import procedure has completed it will prompt to start Check Point services, type “Y” – ENTER
   
3. Disconnect the old server from the network
   
4. Connect the new server to the network
   
5. Connect to the smartcenter using the correct SmartDashBoard version.
   

Upgrade/migration complete, you should see all your policies, gateways, objects, networks etc. Open SmartView Tracker and after a short period the gateways will start logging to the new server. If no logs appear, install a policy to the gateways. As we migrated the database to a new server the old server remains untouched and can be reverted to in the event of an issue.

How to Know Nokia Hardware - Model - Serial Number

FW [Admin]# cat /var/etc/.nvram
Vendor Nokia
Chassis serialnum: 93063100325
Model IP390
FW [Admin]#

How to Find UTM-1 Check Point Appliance Model from CLI

Run the following command:

[Expert@yourfirewall]# /usr/sbin/dmidecode | grep "Product Name"
Product Name: P-10-00

Here is a list of the dmidecode information that I’ve found for various UTM/Power-1 appliances, and the hardware that you can expect to require if you run an open server.

Check Point 2012 Appliance series

DMIDecode	Model	SPU	FW	VPN	IPS	CPU	MHz	RAM
?	21400	2003	50	7	21	2x Intel Xeon E5645 (6 cores)	2.40GHz	6
P-230-00	12600	1861	30	7	17	2x Intel Xeon E5645 (6 cores)	2.40GHz	?
P-220-00	12400	?	?	?	?	?	?	?
P-210-00	12200	738	15	2.5	8	Intel Core i5 750 (4 cores)	2.67GHz	4

Check Point Power-1 Appliance series

DMIDecode	Model	SPU	FW	VPN	IPS	CPU	MHz	RAM
?	11075	up to 1222	20	4	12	2x Intel Xeon E5530 (QC)	2.40Ghz	6
?	9075	1006	16	3.7	10	2x Intel Xeon E5410 (QC)	2.33Ghz	4
P-20-00	9070	?	?	?	?	?	?	?
P-1?-??	5075	596	9	2.4	7.5	Intel Xeon E5410 (QC)	2.33Ghz	2
P-10-00	5070	?	?	?	?	?	?	?

Check Point ??? series

DMIDecode	Model	SPU	FW	VPN	IPS	CPU	MHz	RAM
T-180-00	4800	623	11	2	6	Intel Core2 Quad CPU Q9400	2.66GHz	4
?	4600	374	9	1.5	4	Pentium Dual-Core E6500	2.93GHz	4
?	4400	223	5	1.2	3.5	Intel Celeron Dual-Core E3400	2.6 GHz	4
?	4200	114	3	0.4	2	Intel Atom D525 Dual-Core	1.80GHz	4
?	2200	114	3	0.4	2	Intel Atom D525 Dual-Core	1.80GHz	2
C6P_UTM	2050	?	?	?	?	?	?	?
C6_UTM	1050	?	?	?	?	?	?	?
C2_UTM	450	?	?	?	?	?	?	?

Check Point UTM-1 Appliance series

DMIDecode	Model	SPU	FW	VPN	IPS	CPU	MHz	RAM
U-40-00	3070	298	4.5	1.1	4	Intel Core2 Duo E6400	2.13GHz	3
U-30-00	2070	101	3.5	0.45	2.7	Intel Celeron 440	2GHz	2
U-20-00	1070	101	3	0.35	2.2	Intel Celeron M	1.5 GHz	1
U-15-00	570	101	2.5	0.3	1.7	Intel Celeron M	1.5 GHz	1
U-10-00	270	50	1.5	0.12	1	Intel Celeron M	600 MHz	1
?	130	50	1.5	0.12	1	Intel Celeron M	600 MHz	1

Check Point Smart-1 Appliance series

DMIDecode	Model	CPU	RAM	HDD
?	Smart-1 5	Intel Celeron M 1.50GHz	2	500 GB
?	Smart-1 25b	Intel Core2 Duo Processor E7400 2.80 GHz	4	2 TB
?	Smart-1 50	Intel Xeon E5410 2.33GHz (DualCore)	4	2 TB

 Reference of  this post is http://digitalcrunch.com/check-point-firewall/find-utm-1-check-point-appliance-model-from-cli/

How to Change admin password for Nokia using cli

How to Change admin password for Nokia using cli

clish
> set user admin newpass xxxxx
> save config

How to configure NTP on Splat

How to configure NTP on Splat

Verify if the NTP is running:

# ntpstat
ntp is not running

# which ntp
/usr/sbin/ntp

# cat /usr/sbin/ntp -> you find the configuration file: /etc/sysconfig/ntp

If NTP is not running, this file does not exist. You can create it:

# cat /etc/sysconfig/ntp
INTERVAL=86400 # once per day
SERVER1=10.0.0.1
USE_NTP=true

#service ntp start

# ntpstat
ntp is running

You can make this configuration also using webui.

Modify the expiration date for all users

Modify the expiration date for all users

To change the expiration date for all users, connect to CMA/Smartdashboard in command line and issue this command:

fwm expdate 31-Dec-2017

All the sessions must be closed (for example GUI) or you will have an error like this:
 Lock found indicating rulebase is already being managed by username@LOCATION using fwm

Viewing Checkpoint fw monitor files in Wireshark

How to Viewing Checkpoint fw monitor files in Wireshark

Checkpoints fw monitor utility performs packet captures similar to tcpdump and wireshark. Unlike these utilities it operates above layer 2 and contains no mac address information.  It does contain additional information from the firewall on interface and direction.
To view this additional information in wireshark some extra configuration is required.

1. Select edit/preferences/protocols/ethernet
2. Check the box labelled “Attempt to interpret as Firewall-1 monitor file” and press ok
3. Select edit/preferences/User Interface/columns
4. Click add to add a new column and name it interface.
5. From the format dropdown listbox select FW-1 monitor if/direction and press ok

Save the text below to a file colorise.txt

# DO NOT EDIT THIS FILE!  It was created by Wireshark
@FW-Mon-i @ fw1.direction contains "i"@[65535,65535,0][0,0,0]
@FW-Mon-I @fw1.direction contains "I"@[37008,61166,37008][0,0,0]
@FW-Mon-o@fw1.direction contains "o"@[44461,55512,59110][0,0,0]
@FW-Mon-O@ fw1.direction contains "O"@[31161,49051,54875][0,0,0]

1. Select View/coloring rules
2. Click import and open the saved file from above
3. Select the last 4 rules and move them to the top of the list by clicking the up button
4. Press ok

Your now ready to view the fw monitor files in wireshark.

tcpdump filters

tcpdump filters

A common step in troubleshooting is finding out what not to troubleshoot. With a packet capture you can confirm things such as routing, firewall rules, and remote services.

Once you can prove that a packet is coming back, then you can prove that all layers of the OSI model below are working. For example, if you get an ACK, then you know a few things:

• Layer 1 hardware is probably on and functioning
• Layer 2 Addressing is likely working
• Layer 3 Routing would appear to be working
• Layer 4 Transport is likely working

Session, presentation and application might not be working at this point, but you’ve ruled out several things that don’t need to be tested.

You can do detailed packet captures that look for additional information to verify if layers 5,6 and 7 are working, but this should save you some time to know that layers 1-4 are operational.

It’s possible that intermittent errors, or bandwidth related errors could be hiding, and a packet capture can still help you find this type of error too.

Every serious network and security professional should know how to use tcpdump.

Here are my tcpdump notes, perhaps you’ll find them handy too:

Basic tcpdump flags

-i <interface>

Specify which intterface to capture, defaults to lowest numbered interface

-q

Quick output. Print less protocol information so output lines are shorter, easier to read.

-X

Show binary and hex data

-n

Do not perform DNS lookup, just show the IP

-v

Show additional information, -vv shows more, -vvv shows even more

-s <size>

Size of the Packet, (-s 1514)

-S

Print absolute, rather than relative TCP sequence numbers

src (net)

The source IP of the filter (src 1.1.1.1). src net can be used to specify a network, in CIDR: (dst net 1.1.1.0/24)

dst (net)

The destination IP of the filter (dst 1.1.1.1). dst net can be used to specify a network, in CIDR: (dst net 1.1.1.0/24)

(src|dst) port

which port specifically, can be named ports, or specific port. (dst port 80)

-w <filename>

The name of the file to write out your packet capture to (-w filename.cap)

and

combine filters (and src net 1.1.1.0/24)

not

negate filters (and not dst port 22)

tcpdump filter examples

Here is a list of several ways to build filters, and some of the more common ways that you might want to view data.

tcpdump -nS

Very basic communication.

tcpdump -nnvvS

Basic, verbose communication.

tcpdump -nnvvXS

Get the packet payload, but that’s all

tcpdump -nnvvXSs 1514

Full packet capture with all details

tcpdump host 1.2.3.4

Show traffic to and from 1.2.3.4

tcpdump src 1.2.3.4

Show all traffic from 1.2.3.4

tcpdump dst 4.3.2.1

Show all traffic to 4.3.2.1

tcpdump net 1.2.3.0/24

Look at traffic to and from 1.2.3.0/24

tcpdump port 3389

Remote Desktop example

tcpdump udp and src port 53

specify protocol combined with src port (DNS filter example)

tcpdump portrange 1000-2000

Do you need an explanation? If so, perhaps another article is better for you.

tcpdump -i any -nnvvXSs 1514 -c 100 src 1.2.3.4 port 443 -w capturefile

Capturing full packet, fully verbose, limit to 100 of them, with IP and port filter, write to capturefile for later analysis.

tcpdump -nnvvXSs 1514 src net 192.168.0.0/16 and dst net 10.0.0.0/8 not dst port 22

Like previous tcpdump filter, but also limiting between 2 networks, and ignoring port 22

3 way Handshake Troubleshooting With tcpdump

We are able to confirm routing, firewall rules, and remote service response by looking at the type of packet that comes back:

tcpdump ‘tcp[13] & 2!=0′

SYN messages tell us that at least our client is sending it’s initial outbound message. If that’s all we see, then nothing is coming back and routing could be bad, or the remote server could be down.

tcpdump ‘tcp[13] & 16!=0′

ACK is the acknowledge message. We can see that the traffic is going all the way to and from the client/server and the server is responding.

tcpdump ‘tcp[13]=18′

SYN ACK packets shows active communication between client and server. Routes, ACLs, and Firewall rules are good.

tcpdump ‘tcp[13] & 4!=0′

RST packets. RST packets are sent back from the service, so at least you know the path is good and not blocked by an ACL or firewall.

tcpdump ‘tcp[13] & 1!=0′

FIN packets. FIN packets are sent back from the service, so you also know path and firewall or ACL rules are not blocking.

tcpdump Statistics

Often, on a network a few hosts will be infected, but it’s hard to tell which ones those hosts are. Here is a quick method to help you determine who is spewing the most traffic:

First, get a packet capture of the data that is of interest to you, you can get basic packets, or all of it if you want to review it later. In my example I want to review it later, so I’m capturing the entire packet, with a bit of detail:

#  tcpdump -i any -nn -X -vv -s 1514 -c 1000 -w packetcap.cap

Next run it through awk to display some statistical information:

# tcpdump -nr packetcap.cap | awk '{print }' | grep -oE '[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}' | sort | uniq -c | sort -n

Which produces:

Now I could use tools like nslookup, whois, etc to determine what the most trafficked IP addresses are and adjust my firewall rules accordingly.

Sample tcpdump Output