topic Export Firewall configuration in Firewall and Security Management

Export Firewall configuration

davidso — Tue, 30 Jun 2020 05:54:48 GMT

Hi Mates,

I am using 2 x CheckPoint 5600 Firewall in my workplace.
We are requested by our Internal Audit that we need to export and review the Firewall configuration periodically.
I am the only person here who hold the Firewall Administrator password, and I am not allow to share out the admin pwd.

Can anyone guide me on how to create a READ ONLY account that can export the FireWall Configuration file?

thank you very much.
---david

Re: Export Firewall configuration

_Val_ — Tue, 30 Jun 2020 08:21:22 GMT

What kind of export? MGMT database? OS settings? Please elaborate

Re: Export Firewall configuration

davidso — Tue, 30 Jun 2020 09:18:43 GMT

Only the OS settings. thank you.

Re: Export Firewall configuration

davidso — Tue, 30 Jun 2020 09:20:53 GMT

according to some experts they mention something adding a RULE to allow these READ ONLY accounts to access SSH and the WEB interface that can serve the same purpose. Can you please guide me through how to set this rule(s)? Many Many thanks. --david

Re: Export Firewall configuration

_Val_ — Tue, 30 Jun 2020 09:34:57 GMT

You need to set up a new OS account and assign it to monitorOnly role

Read the Gaia admin guide for more details.https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_Gaia_AdminGuide/Content/Topics-GAG/Roles.htm?tocpath=User%20Management%7CRoles%7C_____0

Re: Export Firewall configuration

davidso — Tue, 30 Jun 2020 09:45:19 GMT

Hi _Val_, The two READ ONLY accounts that i mentioned were exactly in the MonitorRole. But they seem do not have the privilege to export the configuration nor ssh-in. thanks. --david

Re: Export Firewall configuration

_Val_ — Tue, 30 Jun 2020 12:33:51 GMT

Incorrect. You already have built-in monitor user in Gaia. Alternatively, create a new and assign monitorOnly role to it.

This user (you will have to reset its password) is allowed to SSH, CLISH only. It can run "show..." commands. In this context, "show configuration" is what you are looking for.

It will not "export" config out, but will allow auditors to see output of config as part of the ssh session. They can log the session and use the data.

You do not want to give read-only users access to expert. If you are looking for a capability to send a file out, that is exactly the issue. Expert mode trumps all CLISH restrictions.

Re: Export Firewall configuration

davidso — Wed, 01 Jul 2020 11:48:48 GMT

thank you!

Re: Export Firewall configuration

_Val_ — Wed, 01 Jul 2020 11:49:04 GMT

you are welcome