topic Re: CLI command to show FW/IPS Policy in Firewall and Security Management

CLI command to show FW/IPS Policy

Christopher_Ta1 — Mon, 16 Apr 2018 08:05:27 GMT

What cli command to show all installed policy and also ips policy.

Re: CLI command to show FW/IPS Policy

XavierBens — Mon, 16 Apr 2018 13:51:27 GMT

Hi, you can use

cpstat fw

in order to find what policy package is installed on a Security Gateway.

For IPS, you'll have to use

ips stat

in order to check the ips status (active profile, update version, ...)

You can find such commands and lot more in the specific Admin Guide or on the CLI Reference Guide

Re: CLI command to show FW/IPS Policy

Danny — Wed, 20 Aug 2025 06:37:50 GMT

Instead of looking for specific commands, you could also install our
Common Check Point Commands (ccc)
script and have them always interactively available.

Re: CLI command to show FW/IPS Policy

Christopher_Ta1 — Tue, 17 Apr 2018 00:39:43 GMT

I mean, show/list all the firewall policy not the install policy package

Re: CLI command to show FW/IPS Policy

Danny — Tue, 17 Apr 2018 04:33:36 GMT

You want to see all the rules that are installed on the local gateway, right? This is possible starting from R80.10. https://community.checkpoint.com/people/dwelccfe6e688-522c-305c-adaa-194bd7a7becc mentioned the file that contains all the rules a while ago. Let me check and get back to your shortly.

Re: CLI command to show FW/IPS Policy

PhoneBoy — Tue, 17 Apr 2018 10:50:56 GMT

I don't remember saying that, but then again, I've probably forgotten more than I remember about Check Point

You can look in $FWDIR/state/local/FW1 on the gateway...where you'll find all kinds of stuff.

Re: CLI command to show FW/IPS Policy

JozkoMrkvicka — Tue, 17 Apr 2018 19:13:38 GMT

fw stat

for policy status.

Re: CLI command to show FW/IPS Policy

David_Azoulay — Mon, 03 Dec 2018 10:40:54 GMT

the following command will give you TP policy status:

fw stat -b AMW

Re: CLI command to show FW/IPS Policy

kamran_shabir — Mon, 29 Jul 2019 15:21:36 GMT

On R80.10, you can not see Active IPS profile by using command " ips stat " , use following command

# cat $FWDIR/state/local/AMW/local.set | grep -A15 malware_profiles | grep ":name" | awk '{print $2}' | tr -d "()"