How install InitialPolicy after use fw unloadlocal

SecdetKrypton — Fri, 07 Mar 2025 00:50:21 GMT

I used the command fw unloadlocal on my cluster XL gateways, but I would like to install the initial policy. How could I do that?

Re: How install InitialPolicy after use fw unloadlocal

Duane_Toler — Fri, 07 Mar 2025 05:19:08 GMT

This is in the Installation and upgrade guide:

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Installation_and_Upgrade_Guide/Content/Topics-IUG/Security-Before-Firewall-Activation.htm?TocPath=Special%20Scenarios%20for%20Security%20Gateways%7CSecurity%20Before%20Firewall%20Activation%7C_____0

You may (or may not) need to run the initial policy compiler first:

$FWDIR/bin/comp_init_policy [-g | -G]

Creates the local state Initial Policy

Then load the policy manually:

fw fetchlocal -d $FWDIR/state/local/FW1/

InitialPolicy loaded:

[Expert@cpgw01:0]# fw stat HOST POLICY DATE localhost InitialPolicy 7Mar2025 0:11:41 : [>eth0] [<eth0]

Please test this on your own before trying on a production gateway, however! After InitialPolicy is loaded, you can still SSH to the gateway and run various CPD management commands from SmartConsole (or wherever). You can't ping the gateway, however.

If you want to build your own custom default filter, review the documentation section:

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Installation_and_Upgrade_Guide/Content/Topics-IUG/Boot-Security.htm?tocpath=Special%20Scenarios%20for%20Security%20Gateways%7CSecurity%20Before%20Firewall%20Activation%7C_____1

Re: How install InitialPolicy after use fw unloadlocal

Tal_Paz-Fridman — Fri, 07 Mar 2025 08:48:10 GMT

If you haven't installed a different policy (after the uninstall) then just running fw fetch localhost will fetch the Initial Policy.

If you want to install / fetch Initial Policy when there is a different policy you will need compile it and perform additional steps

topic Re: How install InitialPolicy after use fw unloadlocal in Firewall and Security Management

How install InitialPolicy after use fw unloadlocal

Re: How install InitialPolicy after use fw unloadlocal

Re: How install InitialPolicy after use fw unloadlocal