topic Re: fw sam syntax in Firewall and Security Management

fw sam syntax

mva — Thu, 29 Aug 2024 07:28:53 GMT

Hello mates!

We're testing smart event policy and faced next question. If we understood right, if host was blocked because of policy, it block with SAM (logs shows sam rules numbers). Now we're trying to find ways to unblock host before its timeout ends. If we're trying to use fw sam with flag -C and criteria src, we recieves output as from -help flag, and host still blocked. But, if we're using -D flag, all works properly.

For example

fw sam -v -s localhost -f GWIP -C src 1.1.1.1 - facing -help output

fw sam -D - everything correct, hosts unblocked.

Are we missing anything in first example? Tested both on 81.10 and 81.20 with last JHF takes

Re: fw sam syntax

G_W_Albrecht — Thu, 29 Aug 2024 07:46:26 GMT

In https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_CLI_ReferenceGuide/Topics-CLIG/MDSG/fw-sam.htm we read:

-C

Cancels the fw sam command to inhibit connections with the specified parameters.

Notes:

These connections are no longer inhibited (no longer rejected or dropped).
The command parameters must match the parameters in the original fw sam command, except for the -t <Timeout> parameter.

Re: fw sam syntax

mva — Thu, 29 Aug 2024 07:53:10 GMT

So, we need not only source, but also destination and all other params to unblock?

Re: fw sam syntax

the_rock — Thu, 29 Aug 2024 12:10:32 GMT

I have a gut feeling its failing due to localhost. Let me see if I can test it in the lab.

Andy