Viewing the list of the available Firewall integer kernel parameters and their values

Lesley — Thu, 02 May 2024 08:21:42 GMT

Hi everyone,

I found an interesting part of documentation regarding the Integer Kernel Parameters and String Kernel Parameters.

It is possible with a command to show a list of all the parameters and string and the values that have been set.

This is stated in: https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_SecurityGateway_Guide/Content/Topics-FWG/Kernel-Parameters/FireWall-Kernel-Parameters.htm

These are the steps for Integer parameters:

Connect to the command line on your Security Gateway

/ each Cluster Member

Note - On Scalable Platforms (Maestro and Chassis), you must connect to the applicable Security Group.

Make sure you can get the list of the available integer kernel parameters and their values without errors:

Note - The configuration of your Security Gateway might not support all kernel parameters. As a result, the Security Gateway might fail to get the value of some kernel parameters.

modinfo -p $FWDIR/boot/modules/fw_kern*.o | sort -u | grep ':int param' | awk 'BEGIN {FS=":"} ; {print $1}' | xargs -n 1 fw ctl get int

If in the previous step there were no errors, get the list of the available integer kernel parameters and their values, and save the list to a file:

modinfo -p $FWDIR/boot/modules/fw_kern*.o | sort -u | grep ':int param' | awk 'BEGIN {FS=":"} ; {print $1}' | xargs -n 1 fw ctl get int 1>> /var/log/fw_integer_kernel_parameters.txt 2>> /var/log/fw_integer_kernel_parameters.txt

Analyze the output file:

/var/log/fw_integer_kernel_parameters.txt

For string it is similar:

Connect to the command line on your Security Gateway / each Cluster Member.

Note - On Scalable Platforms (Maestro and Chassis), you must connect to the applicable Security Group.

Make sure you can get the list of the available integer kernel parameters and their values without errors:

Note - The configuration of your Security Gateway might not support all kernel parameters. As a result, the Security Gateway might fail to get the value of some kernel parameters.

modinfo -p $FWDIR/boot/modules/fw_kern*.o | sort -u | grep ':string param' | awk 'BEGIN {FS=":"} ; {print $1}' | xargs -n 1 fw ctl get str

If in the previous step there were no errors, get the list of the available string kernel parameters and their values, and save the list to a file:

modinfo -p $FWDIR/boot/modules/fw_kern*.o | sort -u | grep ':string param' | awk 'BEGIN {FS=":"} ; {print $1}' | xargs -n 1 fw ctl get str 1>> /var/log/fw_string_kernel_parameters.txt 2>> /var/log/fw_string_kernel_parameters.txt

Analyze the output file:

/var/log/fw_string_kernel_parameters.txt

I have tried step 3 on a few gateways but it get's stuck on different parameter and does not proceed with the rest.

Step 4 output file contains only an error.

Anyone has an idea how to generate the full list and skip the ones that give an error?

Expample:

(I cut out the above parameters)

bypass_on_enhanced_ssl_inspection = 0
bypass_reverse_dns_rad_request = 1
ccc_in_separate_daemon = 0
ccc_policy_timestamp = 0
Get operation failed: failed to get parameter ccl_correct_dr_between_chassis
get: Operation failed
xargs: fw: terminated by signal

Different gateway:

fwconn_tracker_monitor = 'default'
fwha_azure_default_mac = '12:34:56:78:9a:bc'
fwha_group_of_bonds_str = ''
Get operation failed: failed to get parameter fwha_mbs_amw_policy_time_formated_str
get: Operation failed
xargs: fw: terminated by signal 9

Re: Viewing the list of the available Firewall integer kernel parameters and their values

PhoneBoy — Mon, 06 May 2024 14:42:43 GMT

Good stuff!

Re: Viewing the list of the available Firewall integer kernel parameters and their values

the_rock — Mon, 06 May 2024 14:48:02 GMT

I also tried few fiewalls in the lab and get below on step 3, I guess its expected?

Andy

inline_zp_script = ''
kiss_branch_name = 'unknown'
kiss_flofiler_active = ''
kiss_memory_report_filter = '*'
Get operation failed: failed to get parameter mgmt_forwarding_tcp_ports_list_string
get: Operation failed
xargs: fw: terminated by signal 9

Re: Viewing the list of the available Firewall integer kernel parameters and their values

Timothy_Hall — Sat, 11 May 2024 14:43:52 GMT

This is also documented here which is a bit more updated: sk33156: Creating a file with all the kernel parameters and their values

Re: Viewing the list of the available Firewall integer kernel parameters and their values

the_rock — Sat, 11 May 2024 17:00:36 GMT

I had customer ask me once if it was possible to say run command that would clearly show all kernel parameters and what the impact would be having them turned on. I brought that up to their Sales person as well, but not sure something like that exists.

Andy

topic Viewing the list of the available Firewall integer kernel parameters and their values in Firewall and Security Management

Viewing the list of the available Firewall integer kernel parameters and their values

Re: Viewing the list of the available Firewall integer kernel parameters and their values

Re: Viewing the list of the available Firewall integer kernel parameters and their values

Re: Viewing the list of the available Firewall integer kernel parameters and their values

Re: Viewing the list of the available Firewall integer kernel parameters and their values