How to check rule hit count / statistics in checkpoint?

As I mentioned before once you export firewall logs into human-readable format you can do lots of interesting things – for example script that gives statistics of how many times each Security rule was hit .
Be aware that this counts explicit Security rules only – i.e. the ones you see in Security tab of the Smartdashboard. No other rules you usually see in Smartview Tracker are counted – e.g. SmartDefense,Web Filtering etc. Also afterwards I sort it by number of hits to see what rules are used most:

awk -F\; ' {match($0,/rule: +([0-9]+)/,rules);rule_count[rules[1]]++} END {for (rule_number in rule_count) print " Rule number: " rule_number " Hits: " rule_count[rule_number]}' ./fw.log.txt | sort -n -k5

Rule number:  Hits: 1197330  Ignore this line as it counts 

Checkpoint : How to change Date and time in Secureplatform from CLI??

Login to Linux box as root and enter root's password:
[me@mybox me]$ su
password:

Check the current date and time of the Linux box by entering:
[root@mybox me]# date
Linux yields the current settings:

[root@mybox me]# Wed Apr 7 12:03:45 EDT 2004
Change the current time and date of the Linux box by entering:
[root@mybox me]# date 040713032004
would change the time and yield:
[root@mybox me]$ Wed Apr 7 13:03:00 EDT 2004

====================================================


One more option:

Linux Set Date

Use the following syntax to set new data and time:date set="STRING"

For example, set new data to 2 Oct 2006 18:00:00, type the following command as
root user:# date -s "2 OCT 2006 18:00:00"

Checkpoint Logging Issue / no logs are coming to smart center server from firewall gateway

The following article is a list of steps one should go through when troubleshooting logging related issues in a distributed setup.

1. Ensure that you have not run out of disk space on the hard disk that the logs are being sent to. If this is the case, delete or move the logs to an external storage device.

2. Is there communication between the MS and the Module? Test using ping to the MS from the module and then from the Module to the MS (your rules must allow for this). If this fails, and your rules allow for this, then it is most likely a routing issue.

3. Check to see if the fw.log file is growing on the module. It should be if the logs are not going to the MS. From the console run these commands:

cd $FWDIR/log

ls -la

ls -la

Verify that the fw.log file is increasing. If it is increasing then the modules are logging locally instead of forwarding the traffic to the MS. This could be a connectivity issue, or it could be the way the logging is setup. Check the FW object to ensure it is setup to send logs to the MS.


4. Can you fetch a policy? Verify that you can fetch using the hostname and IP address. If this fails then you probably have a SIC issue. To test this run the following commands:

fw fetch hostname_of_MS

fw fetch IP_Addr_of_MS (fetch by IP address also to ensure it is not a DNS issue)

5. Check the masters file. The hostname or IP address of the management station should be listed in there. To check this run the following commands:

cd $FWDIR/conf

cat masters

It should be look like this:

[Policy]

hostname_of_MS

[Log]

hostname_of_MS

[Alert]

hostname_of_MS

6. Run tcpdumps on the module, listening for port 257 on the interface facing the MS, to see if it is attempting to send logs. To check this run the following command:

tcpdump -i eth-facing-MS port 257 (use the Ctrl+C to break out of the dump)

You should see traffic leaving the FW and heading to the IP address of the MS.

You should also see traffic coming back from the MS.


7. The log file may have gotten corrupt. Run a log switch on the MS and reboot the MS to create a new log file. If logswitch does not work, move all contents of the log directory (do not move the directory itself) to a temp folder outside of the log directory. Reboot and see if the logs start again.

8. Delete the $FWDIR/log files and $FWDIR/state directory files on the module; reboot the module.

Reboot and see if the logs start again.

9. Look to see if there is a listening port for logging. Run the following command on the MS and the module:

netstat -na

You should see the *.257 LISTEN for logging connections. You should also see the IP address of the MS :257 associated with the IP address of each module, and showing an ESTABLISHED connection.

10. Check the log settings for the FW object and make sure the 'Log Server' is set to the MS that should be receiving the logs. This is usually done by default, but may have been changed by a user.


If after going through these steps you are still experiencing logging issues, please open a ticket with Corresponding TAC for further troubleshooting and ofcoz try your way with help of our all time Gaint Mr. Google.. :-)

Nokia : How to check MAC address on Nokia IP / IPSO??

I was thinking how to get the cluster mac address of Nokia IP Cluster with out logging into switches/router after my firewall.. More over I wanted to implement my new decision to Reduce Dependency..


So the command is simple,

######################################

ifconfig -a | grep -i mac

######################################

ofcoz you have to try in master box which configured in forwarding mode..

You will find the cluster mac address just after clustermac

One more thing you might have noticed, "grep -i", Take it as a home work!!! :)))

Check Point FW Monitor White Papers

FW Monitor is Check Point’s packet capture tool. It is similiar to other packet sniffers like TCPDump or Snoop. On of its unique abilities is to capture insertion points. I think the best of the 3 papers is the Nokia one. Enjoy.

Check Point Whitepaper on How to use FW Monitor

Nokia Whitepaper on Check Point FW Monitor

CPUG White Paper FW Monitor

Steve Jobs' 2005 Stanford Commencement Address

Think Different

Here's to the crazy ones. The misfits. The rebels. The troublemakers. The round pegs in the square holes. The ones who see things differently.

They're not fond of rules. And they have no respect for the status quo. You can quote them, disagree with them, glorify or vilify them.

But the only thing you can't do is ignore them. Because they change things. They push the human race forward.

And while some see them as the crazy ones, we see genius.

Because the people who are crazy enough to think they can change the world, are the ones who do.

Họ điên khùng. Không phù hợp. Nổi loạn. Chuyên gây rắc rối. Họ giống như nồi tròn vung méo. Họ nhìn mọi thứ khác với lẽ thông thường.

Họ không ưa các nguyên tắc. Họ làm đảo lộn hiện trạng. Bạn có thể bất đồng với họ, vinh danh hay đả kich họ.

Nhưng bạn không thể không chú ý tới họ. Bởi họ thay đổi thế giới và đưa nhân loại tiến lên phía trước.

Và trong khi họ bị coi là những kẻ điên khùng, chúng tôi lại thấy ở đó phẩm chất của những thiên tài. Bởi những người đủ điên để nghĩ bản thân có thể thay đổi thế giới sẽ chính là những người thực sự làm được điều đó.