topic Hardware: How to determine the CK of an SFP? in Firewall and Security Management

Hardware: How to determine the CK of an SFP?

Quinn_Yost — Wed, 10 May 2017 15:49:37 GMT

Is there a way to determine the CK of an SFP(+) from either a running box or from physical inspection of the module?

In looking at a device, there appear to be two different Serial Numbers.

The first is on the OEM sticker on the top with the MFR part number and Check Point's FRU. This is 7 digits alphanumeric.
The second is on the side of the device with just a barcode sharing the same sticker. This is 10 digits alphanumeric.

The CKs within UserCenter are 12 digits alphanumeric.

Thanks!

Re: Hardware: How to determine the CK of an SFP?

Moti — Thu, 11 May 2017 11:38:25 GMT

Dameon Welch Abernathy

Re: Hardware: How to determine the CK of an SFP?

PhoneBoy — Thu, 11 May 2017 12:25:22 GMT

As far as I know, there is no publicly available tool that will provide this information.

Re: Hardware: How to determine the CK of an SFP?

Tomer_Sole — Thu, 11 May 2017 19:27:41 GMT

right here:

Re: Hardware: How to determine the CK of an SFP?

PhoneBoy — Thu, 11 May 2017 21:16:49 GMT

The question was related to the CK of an accessory, not the CK of the device itself (Though good tip!)

Re: Hardware: How to determine the CK of an SFP?

Markusevc — Fri, 19 May 2017 15:48:36 GMT

Just my two cents…

When we enable the Sync with User Center option between the Management Server and the Usercenter, as defined in sk94064

You will be able to retrieve an accurate hardware inventory including the accessories Certificate Keys.

Attached you will find an example, hope this helps!

Dameon Welch Abernathy

Re: Hardware: How to determine the CK of an SFP?

Quinn_Yost — Fri, 19 May 2017 20:55:04 GMT

Appreciate that response.

I've done most of that same process manually (just matching count of accessory to chassis, not necessarily the CK).

I presume since this information is gathered programmatically, that I should be able to gather the same for a full manual rectify for off-internet devices. That would be a great improvement, but still wouldn't solve identifying accessories in a spare-parts inventory without installing into a test system.

Re: Hardware: How to determine the CK of an SFP?

Markusevc — Thu, 25 May 2017 09:22:24 GMT

Quinn hi again!!!

Actually before I joined Check Point, I was responsible to maintain a large asset inventory, renew contracts, track network obsolesce, vulnerabilities etc. In my case the Check Point Usercenter helped me really a lot because the combined output from the management servers mapped with data from the Usercenter was more accurate than what was available within the “static and always out of sync” corporate asset database.

Related to the User Center Sync, there is indeed a requirement to add the gateways in question into a management server and allow this to connect (if necessary using a proxy) with the Usercenter. This is only required if we want to capture additional device information as defined in sk94064.

However even for assets offline, the Check Point Usercenter adds some value. When products are procured without prior connecting them to the network e.g. “cold spare” the records are still visible within the Usercenter. In fact when you procure an asset including spare parts, Check Point is default mapping them within the Usercenter product repository. If additional accessories are separately procured later, the user can always move or attach the accessory to certain hardware manually.

I hope this answers your question…

Regards, Michel

Example

The following example shows an assets recently procured, not attached to a management server or network.

Accessories TAB

Within this example the user can move or attach accessory to certain hardware manually.