R80.40: fw ctl set int XXX -a errors

Timothy_Hall — Wed, 01 Apr 2020 15:07:04 GMT

While writing the R80.40 addendum for my book, I've come across some strange behavior when setting SIM kernel variables in R80.40 in the context of disabling anti-spoofing "on the fly":

[Expert@gw-38a56d:0]# fw ctl get int sim_anti_spoofing_enabled -a
FW:
Get operation failed: failed to get parameter sim_anti_spoofing_enabled
PPAK 0: sim_anti_spoofing_enabled = 1

[Expert@gw-38a56d:0]# fw ctl set int sim_anti_spoofing_enabled 0 -a
PPAK 0: Get before set operation succeeded of sim_anti_spoofing_enabled
Set operation failed: failed to get parameter sim_anti_spoofing_enabled
set: Operation failed
Killed

[Expert@gw-38a56d:0]# fw ctl get int sim_anti_spoofing_enabled -a
FW:
Get operation failed: failed to get parameter sim_anti_spoofing_enabled
PPAK 0: sim_anti_spoofing_enabled = 0

Clearly the set command is working correctly but throwing all kinds of errors and giving a strong impression that it did not work. Didn't see this error output in R80.20 and R80.30. This is on vanilla R80.40, and I don't see any mention of this behavior in the R80.40 Jumbo HFA. Can someone from R&D explain if there is some better way I should be setting SIM kernel variables as it definitely doesn't seem happy with this technique. Setting "regular" fw kernel variables works fine with no errors. Tagging @PhoneBoy

Re: R80.40: fw ctl set int XXX -a errors

shais — Thu, 02 Apr 2020 07:32:09 GMT

Hi,

The "fw ctl set int" command was changed during R80.20 to allow changing both FW and PPAK global variables.

The command will try to set the variable at the same time in FW and PPAK - if the variable only exist in one of them then the other will fail.

In your examples below, you tried to set global parameter that exist only in PPAK, because of that you can see that FW is failing (no such parameter) and PPAK manage to get/set the parameter

topic Re: R80.40: fw ctl set int XXX -a errors in Firewall and Security Management

R80.40: fw ctl set int XXX -a errors

Re: R80.40: fw ctl set int XXX -a errors