Common Check Point Commands (ccc)

Document created by Danny Jung Champion on Sep 19, 2017Last modified by Danny Jung Champion on Feb 13, 2019
Version 52Show Document
  • View in full screen mode


This Bash script allows you to run common Check Point CLI tasks without having to crawl for command cheat sheets, bookmarks, google, manuals, knowledge base etc.

Moti Sagey's  Top 3 Check Point CLI commands thread inspired me to start this project, allowing everyone to suggest new enhancements, improvements and share their ideas.


To install the script on your Check Point, in Expert mode simply run :

curl_cli | zcat > /usr/bin/ccc && chmod +x /usr/bin/ccc

Or download it to the /usr/bin directory of your Check Point and make it executable.


------------------------------------------------ ccc v4.0 -
System     Firewall Cluster Node (HA) > Active
Type       Open Server
OS         Gaia R80.10 JHF (Take 121) @ 64-bit
CPU        8 Cores 2 licensed | SMT: Off | Load 0.75%
RAM        32 GB (Free 20 GB) | Swapping 148 KB
SecureXL   On | Multi-Queue Interfaces 0/16
CoreXL     On (8 Cores) | Dynamic Dispatcher: On
Core dumps Present | Crash dumps: -
Uptime     2 days
Managed by fwmgmt (IP:
Policy     Standard - Aug 24 2018 `09:37
Blades     FW, VPN, IPS, MOB, ABot, IA, MON
Serial     ############### | MAC: 00:1C:7F:AB:CD:EF
PSU        1: Up  2: Up
Interfaces igb, ixgbe, tg3
RAID       Optimal


Firewall Management & Gateway >
Firewall Management >
Firewall Gateway >
Firewall Troubleshooting >
VPN Troubleshooting >
Gateway Performance Optimization >
VSX Troubleshooting >
MDS Troubleshooting >
QoS Troubleshooting >
Threat Emulation >
Threat Extraction >



0.1 - Initial Release

0.2 - Added more commands

0.3 - Interactive Mode added by Marko Keca

0.4 - Added more commands, removed a bug with the 'View all commands' option, Interface Cleanups

0.5 - Added advanced interface summary developed in this thread

0.6 - Implemented enhancements as suggested by Günther W. Albrecht and Martin Heim, added SIC status check for gateways, general code cleanup

0.7 - Added more Security Management commands and CPU + memory statistics

0.8 - Added IPS/Threat Prevention 'Panic Button' as described in this presentation by Timothy Hall and a command suggested by Maarten Sjouw plus more MDS/VSX commands

0.9 - Implemented enhancements as suggested by Mikael Johnsson and Sven Glock, added commands to enable/disable SecureXL

1.0 - Colors added for better user experience, dropping for out-of-state packets can now be turned on/off thanks to Dameon Welch Abernathy's thread, IPS Update Time is now shown on R80.x systems thanks to Jerom van den Hoek's thread and many other little adjustments to make this a real 1.x release

1.1 - Added system info to Main Menu (props to: Rosemarie Rodriguez & Nathan Davieau for their Healthcheck script), started a Threat Emulation & Extraction section, improved command coloring

1.2 - Enhanced system info as suggested by Martin Heim, improved system information for cluster status

1.3 - Code improvements, replaced several sed with faster tr and cut commands, added more cluster info to Main Menu, corrected checking routines as suggested by Günther W. Albrecht

1.4 - Added Identity Awareness commands, ability to check the postfix email queue (sk114034), MDS additions as suggested by Maarten Sjouw and output optimizations as suggested by Sven Glock

1.5 - Changed interactive mode to support arrow keys for navigation, added usage information, general performance improvements via Bash's builtin parameter substitution, various fixes

1.6 - Added self-update functionality as requested by Vladimir Yakovlev in this thread, implemented more tests to avoid calls to non-existing ressources as mentioned by Günther W. Albrecht

1.7 - Fixed a nasty bug discovered by Aleksei Shelepov and  Günther W. Albrecht. Thanks!

1.8 - Added commands to start/stop the ICA Management Tool, fixed a typo discovered by Ty King 

1.9 - Added cpconfig and mdsconfig utilities, added ipassignment.conf integrity check, improved Multi-Core Performance Tuning commands

2.0 - Improved detection for supported OS as suggested by cciesec2006 at CPUG, added commands for CoreXL Dynamic Dispatcher and Firewall Priority Queue handling

2.1 - Added more details to system info (memory, CPU cores, CoreXL & SecureXL statistics), added migrate export command to Firewall Management section, improved several checks

2.2 - Fixed Firewall Management commands as suggested by Günther W. Albrecht

2.3 - Added more commands for mail handling tasks within Check Point Threat Emulation & code optimization as suggested by Maciej Maczka

2.4 - Added Threat Extraction Bypass commands as suggested by Niels van Sluis, added command to show calculated interface topology for easier address spoofing troubleshooting, general code and interface cleanup

2.5 - Added command to check the LOM of Check Point Appliances, improved Address Spoofing commands as suggested Norbert Bohusch

2.6 - Improved system information as suggested by Michael Asher, added VPN routing information as developed in Heiko Ankenbrand's thread

2.7 - Added IA command as suggested by Hans Hartung. Introduced a QoS Troubleshooting section and several code improvements as suggested by Alexander Wilke

2.8 - Improved system info (new: SMT, CPU Load, Multi-Queue Interfaces and Dynamic Dispatcher), added more performance tuning commands, minor script code fixes

2.9 - Added more system info (new: Policy, Blades), improved check for number of Multi-Queue interfaces, added Postfix queue message distribution commands as suggested by Benoit Verove

3.0 - Improved script starting time, added status dots to script starting routine, added Jumbo Hotfix take number and free RAM to system info

3.1 - Added performance troubleshooting commands (sar, iotop etc.), added check for licensed cores and OS edition to system info, fixed a parameter gone in R80.20 as mentioned by Günther W. Albrecht

3.2 - Added more details to system info as suggested by Rolf Peeters and Jozko Mrkvicka, improved script code, added user confirmation before executing commands

3.3 - Added Endpoint Management support, improved check for number of permitted cores as discussed in this thread

3.4 - Added more warning markup to system info, added core & crash dump checks, added commands to view and edit the malware policy on Threat Prevention gateways

3.5 - Fixed a syntax error spotted by Kaloyan Metodiev, improved crash dump location check, added max power script command

3.6 - Replaced a Non-Standard ASCII character spotted by Martin Heim, added red warning label to SecureXL and CoreXL when disabled, minor code improvements

3.7 - Added Tim Hall's Super Seven” performance assessment commands from this TechTalk session

3.8 - Added more commands to MDS Troubleshooting, fixed Multi-Domain Server OS string handling, improved error handling

3.9 - Revised the self-update mechanism to support user control, added more commands to Firewall Management and MDS Troubleshooting, minor code fixes

4.0 - Added support for t, f, g, h keys (when arrow keys don't work) as suggested by Vladimir Yakovlev

197 people found this helpful