topic Re: Show VPN Routing on CLI in Scripts

Show VPN Routing on CLI

HeikoAnkenbrand — Tue, 01 Dec 2020 16:26:03 GMT

The following command shows detailed policy based routing on the CLI. You found the policy based VPN routes to the corresponding external gateway. The basic Check Point table is "fw tab -f -t vpn_routing -u".

Command:

echo -e "\033[0m####################\n# VPN Routing #\n####################";fw tab -f -t vpn_routing -u 2>&1 |grep -v "+"| awk '{split($0,a,";"); print a[8]}' |sort -ng |uniq | awk '{split($0,a," "); print a[2]}' | xargs -I % sh -c 'echo -n "External Gateway: ";echo -e "\033[0;31m % \\033[37m";echo -e " Routing: \033[32m";fw tab -f -t vpn_routing -u 2>&1 |grep % |awk '\''{split($0,b,";"); print b[6] b[7]}'\''| sed 's/From\://'| sed 's/To\:/-/'|sort -u ;echo -e "\033[0m" '

Regards,

Heiko Ankenbrand

Re: Show VPN Routing on CLI

Armin_Weiler — Thu, 05 Jul 2018 14:11:18 GMT

Great job!

Re: Show VPN Routing on CLI

Claudio_Bolcato — Thu, 05 Jul 2018 20:49:48 GMT

Amazing!!!
Thanks for sharing.

Re: Show VPN Routing on CLI

ED — Fri, 06 Jul 2018 07:30:06 GMT

Thanks for sharing.

Re: Show VPN Routing on CLI

Kim_Moberg — Sat, 07 Jul 2018 09:08:59 GMT

Awsome. Thank you for sharing.

Do you have a way to reset vpn tunnel via command line?

I would like to automate vpn tu procedure.

Re: Show VPN Routing on CLI

HeikoAnkenbrand — Sat, 07 Jul 2018 12:41:29 GMT

Hi Kim,

I think you can use the following commands to delete vpn connections.

vpn tu del ipsec all
vpn tu del ipsec ip-addr
vpn tu del ipsec ip-addr username
vpn tu del all
vpn tu del ip-addr
vpn tu del ip-addr username

Regards,

Heiko

Re: Show VPN Routing on CLI

Rolf_Kaschek — Mon, 23 Jul 2018 07:05:14 GMT

Nice command.

Re: Show VPN Routing on CLI

Ukko_Metsola — Mon, 23 Jul 2018 07:11:46 GMT

Is it possible to add ProxyID‘s to the routes?

Re: Show VPN Routing on CLI

jessica_smith — Thu, 18 Oct 2018 15:18:52 GMT

When I try the show vpn routing on cli on the FW, it does not work.

[Expert@fw1-sydney-a]# echo -e "\033[0m####################\n# VPN Routing #\n####################";fw tab -f -t vpn_routing -u 2>&1 |grep -v "+"| awk '{split($0,a,";"); print a[8]}' |sort -ng |uniq | awk '{split($0,a," "); print a[2]}' | xargs -I % sh -c 'echo -n "External Gateway: ";echo -e "\033[0;31m % \\033[37m";echo -e " Routing: \033[32m";fw tab -f -t vpn_routing -u 2>&1 |grep % |awk '\''{split($0,b,";"); print b[6] b[7]}'\''| sed 's/From\://'| sed 's/To\:/-/'|sort -u ;echo -e "\033[0m" '
####################
# VPN Routing #
####################
xargs: invalid option -- I
BusyBox v1.8.1 (2017-11-29 13:01:08 IST) multi-call binary

Usage: xargs [OPTIONS] [COMMAND] [ARGS...]

Execute COMMAND on every item given by standard input

Options:
-p Prompt the user about whether to run each command
-r Do not run command for empty read lines
-x Exit if the size is exceeded
-0 Input filenames are terminated by a null character
-t Print the command line on stderr before executing it

sort: unknown sort type

Re: Show VPN Routing on CLI

Maria_Pologova — Wed, 05 Dec 2018 18:51:24 GMT

For me doesn't give any output for some reason. R77.30 Take 338. fw tab -t vpn_routing -u -f works though.

Re: Show VPN Routing on CLI

AlexeyB — Fri, 07 Dec 2018 03:12:19 GMT

Because in actual script additional param seted: "grep -v '+' ". You may use simplified command like this:

fw tab -t vpn_routing -u | awk 'NR>3 {$0=substr($0,2,28); gsub(", ", ""); gsub("; ", ""); gsub("..", "0x& "); print}' | xargs printf "%d.%d.%d.%d\t-\t%d.%d.%d.%d\tPeer: %d.%d.%d.%d\r\n"‍

Checked on many takes of 77.30

Re: Show VPN Routing on CLI

Maria_Pologova — Sat, 08 Dec 2018 12:30:55 GMT

Brilliant, thank you Alexey. For myself just added sorting by first column.

fw tab -t vpn_routing -u | awk 'NR>3 {$0=substr($0,2,28); gsub(", ", ""); gsub("; ", ""); gsub("..", "0x& "); print}' | xargs printf "%d.%d.%d.%d\t-\t%d.%d.%d.%d\tPeer: %d.%d.%d.%d\r\n" | sort -k1n,1‍

Re: Show VPN Routing on CLI

Pankaj_Mishra — Fri, 04 Jan 2019 10:31:07 GMT

Is there any option to edit VPN routes in Kernel ? I have many routes from one peer (not in my control) and I need to remove one route. Please suggest.

Re: Show VPN Routing on CLI

Benjamin_Lacaze — Tue, 05 Feb 2019 17:09:49 GMT

Hi,

I adapted the full command to work on a R77.30 Gaia, with the same display as the screenshot:

echo -e "\033[0m####################\n# VPN Routing      #\n####################";fw tab -f -t vpn_routing -u 2>&1 |grep "+"| awk '{split($4,a,";"); print a[6]}' |sort -ng |uniq | awk '{split($0,a,":"); print a[2]}' | xargs -I % sh -c  'echo -n "External Gateway: ";echo -e "\033[0;31m % \\033[37m";echo -e "  Routing: \033[32m";fw tab -f -t vpn_routing -u 2>&1 |grep % |awk '\''{split($4,b,";"); print "  "b[2] b[3]}'\''| sed 's/From\://'| sed 's/,To\:/---/'|sort -u ;echo -e "\033[0m"'‍

Re: Show VPN Routing on CLI

AlexeyB — Wed, 06 Feb 2019 01:47:00 GMT

Now you may compare scripts execution times. My version is faster. Because I don't use `-f` for formating output and I call `fw tab` only once. After all my colleague just added additional sorting for outpue like this:

sort -t . -k 1,1n -k 2,2n -k 3,3n -k 4,4n

Re: Show VPN Routing on CLI

Danny — Thu, 11 Jul 2019 07:29:57 GMT

Hi @AlexeyB,

I like your solution and created a One-liner from it that also adds grouping and coloring, which is also included with our ccc script.

Re: Show VPN Routing on CLI

AlexeyB — Mon, 29 Apr 2019 03:18:23 GMT

Hi, @Danny I didn't specifically group the output so that it would be convenient to filter the output line by line, using "grep" to filter by peer or the specific network you need. Everyone can adapt this command to their own needs. I'm glad that my code was useful to someone 🙂

Re: Show VPN Routing on CLI

Solo — Thu, 12 Dec 2019 02:10:53 GMT

it works,thanks!

Re: Show VPN Routing on CLI

David_Brodin — Thu, 16 Sep 2021 13:48:54 GMT

Cleaned it up for at least r80.30:

echo -e "\033[0m####################\n# VPN Routing #\n####################"; fw tab -f -t vpn_routing -u 2>&1 | grep -v "+\|\-2" | awk '{split($0,a,";"); print a[6]}' | sort -g | uniq | awk '{split($0,a," "); print a[2]}' | xargs -I % sh -c 'echo -n "External Gateway: "; echo -e "\033[0;31m % \\033[37m"; echo -e " Routing: \033[32m"; fw tab -f -t vpn_routing -u 2>&1 | grep -v "+\|\-2" | awk '\''{split($0,b,";"); print b[4] b[5]}'\'' | sed 's/From\://' | sed 's/To\:/-/' | sort -u; echo -e "\033[0m"'

Re: Show VPN Routing on CLI

Jesus — Wed, 31 Aug 2022 12:17:40 GMT

Great job!!!