topic CheckPoint Gateway HitCount in Firewall and Security Management

CheckPoint Gateway HitCount

Pavan9096 — Fri, 06 Dec 2024 10:58:42 GMT

I can run the API/command on the Check Point Management Server to retrieve the hit counts for security rules, but it provides the aggregate hit counts for all gateways on which security policy applied rather than specific ones.

Is there a command, API, or method available to collect the security rule hit counts directly from a local gateway instead of through the Management Server?

Re: CheckPoint Gateway HitCount

the_rock — Fri, 06 Dec 2024 14:27:41 GMT

Maybe this?

Andy

https://sc1.checkpoint.com/documents/latest/APIs/index.html?#clish/show-access-rule~v2%20

CheckPoint Gateway HitCount

CheckMatesAI — Fri, 06 Dec 2024 14:32:49 GMT

This answer is provided by Infinity AI Copilot and should be confirmed by reviewing official documentation in Support Center.

Currently, there isn't a direct command or API to retrieve security rule hit counts directly from a local gateway. The hit counts are typically aggregated and retrieved through the Check Point Management Server.

However, you can use the cpstat command on the Management Server to get hit counts for a specific Security Gateway and save it to a file. Here's how you can do it:

Connect to the command line on the Management Server.
Log in to the Expert mode.
Use the following command to get the hit count for a specific Security Gateway:
```
cpstat -h <IP Address of Security Gateway Object> blades > /var/log/HitCount_for_GW.txt 
```
Replace <IP Address of Security Gateway Object> with the actual IP address of your Security Gateway.

This method allows you to export the hit count data for a specific gateway, but it still requires access through the Management Server. If you need further assistance or have any other questions, feel free to ask!

Re: CheckPoint Gateway HitCount

PhoneBoy — Fri, 06 Dec 2024 14:35:00 GMT

To confirm the answer by CheckMatesAI, see: https://support.checkpoint.com/results/sk/sk135212

Re: CheckPoint Gateway HitCount

the_rock — Fri, 06 Dec 2024 14:39:20 GMT

@PhoneBoy

Not sure if this looks right (just did it in my lab), but seems some info is missing...

Andy

[Expert@CP-MANAGEMENT:0]# cpstat -h 172.16.10.249 blades > /var/log/hitcount_for_gw.txt
[Expert@CP-MANAGEMENT:0]# more /var/log/hitcount_for_gw.txt

Packets accepted : 44090826
Packets dropped : 13516
Peak number of connections: 1019
Number of connections: 7

Top Rule Hits
-----------------------
|rule index|rule count|
-----------------------
-----------------------

[Expert@CP-MANAGEMENT:0]#