topic Re: How to create firewall rules analysis from cpinfo in Firewall and Security Management

How to create firewall rules analysis from cpinfo

Abeja_huhuhu — Thu, 10 Nov 2022 05:03:37 GMT

Hi Guys,

i would like to know, is it possible for us to get firewall rules hits just from cpinfo? the main objective is to get which rules should be prioritize. I believe this is easily being done on R80 above. However, we still have customers running on R77 and currently they are not able to upgrade their firewall at the moment. so we need to check and optimize their firewall rules. Please advise.

thanks.

Re: How to create firewall rules analysis from cpinfo

Arik_Ovtracht — Thu, 10 Nov 2022 08:54:45 GMT

Hi,

R77 versions are not officially supported by Check Point, so we cannot add any features to those versions.

Re: How to create firewall rules analysis from cpinfo

Lesley — Thu, 10 Nov 2022 08:57:10 GMT

No CPinfo will contain data like:

System message logs
Module version information
Installed hotfixes information
OS and network statistics
Interfaces and devices information
Various FW1 tables
Configuration and database files
Core dump files

If you would like to export the rulebase you could try this legacy tool, the Web Visualization Tool:

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk64501

I doubt it contains the hit counter, but you can see the screenshot of the tool in the SK if it meets the requirement.

To be honest, I would prefer direct access to the system and clean-up rules from there.

Re: How to create firewall rules analysis from cpinfo

Abeja_huhuhu — Thu, 10 Nov 2022 08:57:45 GMT

hi @Arik_Ovtracht thanks for the updates.

Re: How to create firewall rules analysis from cpinfo

Abeja_huhuhu — Thu, 10 Nov 2022 09:00:02 GMT

Hi @Lesley Noted. i will try to see if this can help me. thanks.

Re: How to create firewall rules analysis from cpinfo

G_W_Albrecht — Thu, 10 Nov 2022 13:54:59 GMT

Tried sk135212: How to export the rulebase Hit Count ? Other possible way is https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92889&partition=Advanced&product=Quantum showing the SQL hit count database.