topic Re: policy.w file in Firewall and Security Management

policy.w file

kehagen — Wed, 15 May 2024 16:36:45 GMT

Hello,

I'm in the process of upgrading and I need to get Policy.W files off of the gateways. I have found the rulebases_5_0.fws and objects_5_0.C in the /opt/CPsuite-R77/fw1/conf directory, but I cannot find the Policy.W file anywhere. I can find _StatefulPolicy_.W in that same directory, but not Policy.W. Anybody know where I can find it?

Re: policy.w file

the_rock — Wed, 15 May 2024 16:45:38 GMT

Hey Kenny,

Not sure that file even exists, I searched it with find command, nothing came up

Andy

[Expert@CP-FW-01:0]# find / -name Policy.W
[Expert@CP-FW-01:0]# find / -name policy.W
[Expert@CP-FW-01:0]#

Re: policy.w file

the_rock — Wed, 15 May 2024 16:54:08 GMT

Not sure if this is related, but theres a file in below dir (name would be different for you). File is called policy.map

[Expert@CP-FW-01:0]# pwd
/opt/CPsuite-R81.20/fw1/state/CP-CLUSTER/FW1

On the mgmt server:

[Expert@CP-management:0]# cd /opt/CPsuite-R81.20/fw1/state/
[Expert@CP-management:0]# ls
CP-cluster CP-smart-event-server __tmp local
CP-gateway InternalCA_site.p12 links.C
[Expert@CP-management:0]# cd CP-cluster/
[Expert@CP-management:0]# ls
AMW FW1
[Expert@CP-management:0]# cd FW1/
[Expert@CP-management:0]# ls
auxfiles.map
local.DynamicContent
local.Sandbox-persistence.xml
local._policy_metadata
local.ad_query_profiles
local.allowed_clients_objects
local.appfw_misc
local.application
local.category
local.ccp
local.cloudShadowObjectsDumpForGateway
local.cluster_member
local.cmsDumpForGateway
local.connectra_global_properties
local.connectra_policy
local.cpmi_file
local.ctlver
local.current_recovery.profile
local.data_awareness_settings
local.data_files
local.db
local.dcerpc_service
local.device_settings_transactions
local.domain_objects_for_web_applications
local.dynobj
local.embedded_applications
local.eps_notify.html
local.eps_notify.mail
local.external_obj
local.fc
local.fc6
local.file_types
local.fileslist
local.ft
local.ft6
local.fwrl.conf
local.gateway
local.gateway_cluster
local.gateway_general_properties
local.global_preferences
local.gtp_services
local.host
local.host_ckp
local.httpsi_dnd
local.icmp_service
local.icmpv6_service
local.ics_configuration
local.identity_awareness_custom_settings
local.identity_roles
local.ifs
local.implied_rules
local.inspect.lf
local.intranet_community
local.ips_enhance
local.ips_granular_contexts
local.languages
local.lg
local.lg6
local.logo_directory_content.conf
local.magic
local.mail_servers
local.mgmt_dhcp_data
local.mobile_profiles
local.mobile_profiles_rulebase
local.mv_tag
local.nac_agents
local.nat_dnd
local.network
local.network_applications
local.network_group
local.objects
local.policy
local.policy.xml
local.products_updates
local.rad_services
local.realm_objects
local.realms
local.remote_access_clients_objects
local.rpc_service
local.rule
local.rule_adtr
local.rulebase
local.rulebase_tracks
local.sdopts.rec
local.securid
local.security_zone
local.service_group
local.set
local.sic_name
local.sr_community
local.ssl_certificates
local.ssl_inspection
local.sso_groups
local.str
local.str6
local.tcp_protocol
local.tcp_service
local.thresholds.conf
local.track
local.udp_protocol
local.udp_service
local.updatable_obj
local.user_check_interactions.C.converted
local.userdef
local.{939922F7-DF98-4988-B776-B70B9B8340F3}
local.{B9D14722-3936-4B33-814B-F87EA4062BEB}
policy.info
policy.map
[Expert@CP-management:0]# pwd
/opt/CPsuite-R81.20/fw1/state/CP-cluster/FW1
[Expert@CP-management:0]#

Re: policy.w file

the_rock — Wed, 15 May 2024 18:44:32 GMT

By the way, for policy brother, thats ONLY on the mgmt server, so no need to really check those files on the gateway.

Andy

Re: policy.w file

kehagen — Wed, 15 May 2024 21:47:54 GMT

That's what I thought, but our consultant told me to get them from the gateway.

Re: policy.w file

the_rock — Wed, 15 May 2024 22:02:28 GMT

With all due respect, I think consultant is mistaken here 🙂

Andy

Re: policy.w file

kehagen — Thu, 16 May 2024 13:59:29 GMT

I agree with you. I sent them your comment. Thanks buddy!

Re: policy.w file

the_rock — Thu, 16 May 2024 14:01:28 GMT

No problem brother! By the way, just for the context, its totally different as say if you had Fortigate fw, without forti analyzer or fortimanager, ONLY the fw, well, then everything would be that fw alone, as there would be no other entity.

Best,

Andy

Re: policy.w file

G_W_Albrecht — Fri, 17 May 2024 07:55:57 GMT

This file <policy_name>.W only exists on SMS during the first stage of policy install - an old picture from How-To-Troubleshoot-Policy-Installation-Issues shows it:

Re: policy.w file

the_rock — Thu, 16 May 2024 16:05:20 GMT

Man, that looks OLD lol. Anyway, I dont believe you can find it anywhere in newer versions, or even starting from R80?

Andy

Re: policy.w file

PhoneBoy — Fri, 17 May 2024 02:30:15 GMT

If you have rulebases_5_0.fws, you have all the policy packages (and associated rules) in one file.
Why do you need the .W file specifically?

Re: policy.w file

the_rock — Fri, 17 May 2024 02:40:39 GMT

Just for my own knowledge, did policy.w file ever exist, even on older versions? I personally never recall seeing it.

Re: policy.w file

PhoneBoy — Fri, 17 May 2024 14:06:51 GMT

It's policy_name.W, but yes, it's as @G_W_Albrecht explained above.

Re: policy.w file

the_rock — Fri, 17 May 2024 02:45:39 GMT

Ah,kk, yes, that does exist, I thought @kehagen meant EXACT name of the file was just policy.W...Im thinking, wait, NEVER heard of such a name haha

Andy

Re: policy.w file

G_W_Albrecht — Fri, 17 May 2024 07:55:25 GMT

This is in sk11844 from 28.September 2011 - and no, this sk is deleted, and you will not find it in newer versions of the document...

Re: policy.w file

the_rock — Fri, 17 May 2024 09:47:23 GMT

Makes sense, cheers.

Andy