topic Re: Show Ruleset and Objects on the Gateway (Emergency Recovery) in Firewall and Security Management

Show Ruleset and Objects on the Gateway (Emergency Recovery)

HeikoAnkenbrand — Thu, 29 Jan 2026 14:10:38 GMT

I had an emergency case at the customer that the management server (virtual server under VMWARE) was encrypted by an encryption trojan. The VMWare datastore was encrypted and also the virtual management server. Thus, the management server became unusable. Unfortunately, there was no backup, snapshot or "mirate server export" of the management server.

The big question was, can we reconstruct the policy and the corresponding objects on the gateway.

I found an interesting way to show the currently running policy and objects on the gateway.

Show layer structure:

db_tool -p /opt/CPsuite-R81.10/fw1/state/local/FW1 get_layers

Show installed ruleset:

db_tool -p /opt/CPsuite-R81.10/fw1/state/local/FW1 get_rules

Show all installed objects and object settings:

db_tool -p /opt/CPsuite-R81.10/fw1/state/local/FW1 get_rules |grep UUID | awk '{split($0,a,":"); print a[2]}' | uniq | awk ' { cmd="db_tool -p /opt/CPsuite-R81.10/fw1/state/local/FW1 get_object -u "$1;system(cmd)}'

Show IP spoofing settings:

ifconfig -a |grep -B 1 inet |grep encap| awk '{print $1}' | grep -v lo | grep -v ":" | grep -v ^lo | xargs -I % sh -c 'echo %;echo -n " VIP "; cphaprob -a if |grep %|grep -v U|grep -v D | cut -c16-| tr -d "\r\n" ;echo;echo -n " IP ";ifconfig % | grep "inet addr" | cut -d ":" -f 2 | cut -d " " -f 1;echo -n " Mask " ;ifconfig % | sed -rn "2s/ .*:(.*)$/\1/p";echo -en " ANTISPOOFING ENABLED:\t";more $FWDIR/state/local/FW1/local.set |grep -A 30 % | grep has_addr_info | cut -c17- | tr \) " " |sort -n| uniq ; echo -en " ANTISPOOFING MODE:\t"; if [ `more $FWDIR/state/local/FW1/local.set |grep -A 30 % | grep monitor_only | cut -c16- | tr \) " " |sort -n| uniq| grep -o false` ]; then echo "PREVENT"; else echo "DETECT"; fi; echo -en " ANTISPOOFING TOPO:\t"; if [ `more $FWDIR/state/local/FW1/local.set |grep -A 30 % | grep external | cut -c12- | tr \) " " |sort -n| uniq| grep -o true` ]; then echo "External"; else echo "Internal"; fi;echo " ADDRESS SPOOFING NETWORKS:";more $FWDIR/state/local/FW1/local.set | grep -A 30 %|grep ": (\""|sort -n| uniq |tr \<\>\:\" \ ;echo " "'

Version:
1.0 first oneliner 2022-08-25
2.0 R82 and R82.10+ version 2026-01-27

Re: Display Ruleset and Objects on the Gateway (Emergency Recovery)

Danny — Tue, 23 Aug 2022 19:12:14 GMT

Repost plus some additions of what @deniskr posted 2 weeks ago here.

TAC / PS have developed a CP-internal method to recover the security policy from a gateway. Ask them for help in such cases.

Re: Display Ruleset and Objects on the Gateway (Emergency Recovery)

_Val_ — Wed, 24 Aug 2022 10:07:21 GMT

Heiko, could you elaborate about "encrypted by a trojan"? Was it a VM, and the VM server got encrypted? I hardly believe a trojan could do anything on the HW-based Gaia server in the first place...

Re: Display Ruleset and Objects on the Gateway (Emergency Recovery)

HeikoAnkenbrand — Wed, 24 Aug 2022 19:52:45 GMT

YES, the encryption trojan has encrypted the complete VMWare datastore. This meant that all virtual machines could no longer be used. The management server was also affected because it was also virtual system.

I have corrected this in the text above

Re: Display Ruleset and Objects on the Gateway (Emergency Recovery)

_Val_ — Thu, 25 Aug 2022 11:00:43 GMT

Understood, thanks for clarifying.

Re: Show Ruleset and Objects on the Gateway (Emergency Recovery)

CheckPointerXL — Fri, 26 May 2023 12:31:11 GMT

Hi all,

i've a similar problem. The management server got corrupted after a VMware upgrade and no backup/snapshot.

I can access gaia system but it seems that a ton of linux commands and clish shell are corrupted too (unable to use).

So i was thinking about two fix:

- Try to extract the database from the OS to a new deployed management to test a migrate server (this command it doesn't work on corrupted VM). Anyone is able to identify in which folder/partition the database it is located?

- Try to fix the corrupted system: no access to clish so i cannot perform, for example, a software upgrade... any idea?

Re: Show Ruleset and Objects on the Gateway (Emergency Recovery)

the_rock — Fri, 26 May 2023 12:55:35 GMT

Im pretty sure below is all database related on mgmt server

$CPDIR/database folder

Andy

[Expert@QUANTUM-MANAGEMENT:0]# cd /opt/CPshrd-R81.20/database/
[Expert@QUANTUM-MANAGEMENT:0]# ls
CPCoreUploader
EntMgr_BC_DB.xml
EntMgr_DB.xml
EntMgr_DB.xml.org
ICA_QUANTUM-MANAGEMENT_a2n_net_uhsukv_ac03fe.crl
cpdiag
cpeps
cpeps_verification
cprid
downloads
entitlement_status_collector_db.C
entitlement_status_collector_db.C.backup
fingerprints.txt
postgresql
[Expert@QUANTUM-MANAGEMENT:0]#

Re: Show Ruleset and Objects on the Gateway (Emergency Recovery)

CheckPointerXL — Fri, 26 May 2023 12:57:13 GMT

i will try to move that folder on a new mgmt and to test a migrate server on it

thanks !

Re: Show Ruleset and Objects on the Gateway (Emergency Recovery)

the_rock — Fri, 26 May 2023 12:59:04 GMT

Also, attached a file that describes a process building new mgmt from scratch (old school method). Never tried in R80+, but I bet it still works.

Andy

Re: Show Ruleset and Objects on the Gateway (Emergency Recovery)

_Val_ — Fri, 26 May 2023 13:43:57 GMT

No, it will not. The procedure is incomplete, and only works for R7x and below.

Re: Show Ruleset and Objects on the Gateway (Emergency Recovery)

the_rock — Fri, 26 May 2023 13:50:48 GMT

Good to know!

Re: Show Ruleset and Objects on the Gateway (Emergency Recovery)

Luc_Cormorand — Tue, 23 Jan 2024 20:50:28 GMT

Check Point PS Team develops a tool that is able to rebuild mgmt from gateway with some limitations...Name is SmartRescuer.

Contact your local CP Sale or SE...At least contact Miser Val that will forward us the request.

Re: Show Ruleset and Objects on the Gateway (Emergency Recovery)

the_rock — Tue, 23 Jan 2024 21:00:11 GMT

Never heard of it...its for R80+ versions?

Andy

Re: Show Ruleset and Objects on the Gateway (Emergency Recovery)

Luc_Cormorand — Tue, 23 Jan 2024 21:03:04 GMT

we developped in the past for R77.x but we also developped for R80.x as well.

It is a service not a free tool but helped already many customers.

Re: Show Ruleset and Objects on the Gateway (Emergency Recovery)

the_rock — Tue, 23 Jan 2024 21:06:07 GMT

I figured its not free, otherwise, Im sure I would have seen it on support site lol

Personally, I always tell the customers to generate VM snapshot if they use vmware for mgmt or if its open server, then have recent backup and snapshot too, you never know. Broken management server is pretty bad situation.

Cheers,

Andy

Re: Show Ruleset and Objects on the Gateway (Emergency Recovery)

Luc_Cormorand — Tue, 23 Jan 2024 21:14:27 GMT

And you are fully right...Check Point provides so many ways to backup the management database...However, just last year, we were contacted more than 20 times to restore management from gateway.

I am happy to develop the "useless" tool...until the next time a customer will see the usefulness of this service.

Re: Show Ruleset and Objects on the Gateway (Emergency Recovery)

the_rock — Tue, 23 Jan 2024 21:17:24 GMT

I never said it was useless LOL

I cant comment on it at all, as the only way for me to make judgment is if I saw how it works myself, thats it. If it helped 20 customers, I would say thats really good!

Best,

Andy

Re: Show Ruleset and Objects on the Gateway (Emergency Recovery)

Luc_Cormorand — Tue, 23 Jan 2024 21:21:42 GMT

We said "internally it is an useless tool"....But we are happy to see it is not so useless 🙂

One day I will show you the tool...in the meantim, if you have some customers that did not follow your recommendations, please ping me.

regards

Re: Show Ruleset and Objects on the Gateway (Emergency Recovery)

the_rock — Tue, 23 Jan 2024 21:24:46 GMT

Thats good to know! No, personally, my company would not need it, as we have people who been around CP products real long time.

But, I would like to see how it works one day...I love to learn new things.

Best,

Andy

Re: Show Ruleset and Objects on the Gateway (Emergency Recovery)

MartinOles — Wed, 24 Jan 2024 11:27:39 GMT

I am in similar situation, management server is gone, gateways fortunately are still working. Commands works like charm, thank you for them, I am able to "reconstruct" rulebase, objects used and antispoofing.

Is it also possible to extract also NAT rules?

Thank you.