https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/100064#M7809 <P>You can't specify a chain position in combination with <STRONG>-F</STRONG>.&nbsp; When using <STRONG>-e</STRONG> you are basically writing inspection code that is inserted as new chain modules into the chain sequence of modules in the F2F path to grab the traffic; in that case you can most definitely specify chain positions.&nbsp; However all the <STRONG>-F</STRONG> option is doing is setting a kernel debug in the SecureXL Implementation Module (sim) to grab packets matching the <STRONG>-F</STRONG> criteria as they go by, whether they are accelerated or not.&nbsp; All inbound traffic must pass through SIM first no matter the processing path (SXL, PSLXL, F2F, etc.) or whether it gets dropped somewhere later, so you should see everything with <STRONG>-F</STRONG>.&nbsp; Unfortunately you don't have the full suite of INSPECT capabilities for what is essentially a kernel debug via <STRONG>-F</STRONG>, which is why the matching criteria is so restrictive with that fw monitor option.</P> <P>I was initially certain that using <STRONG>fw monitor -p all</STRONG> (<EM>DON'T RUN THIS ON A PRODUCTION FIREWALL</EM>) would only show traffic in the F2F path, but it looks like that is not the case on R80.40:</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="fwmonitorpall.png" style="width: 999px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/8615i7BB0385DDC03069B/image-size/large?v=v2&amp;px=999" role="button" title="fwmonitorpall.png" alt="fwmonitorpall.png" /></span></P> <P>So next I tried stepping through with commands<STRONG> fw monitor -pi 1</STRONG>,&nbsp;<STRONG>fw monitor -pi 2</STRONG>, etc. trying to see the earliest point a successful insertion could occur without getting a "no room" message as reported by <a href="https://community.checkpoint.com/t5/user/viewprofilepage/user-id/20425">@Srdjan_B</a>.&nbsp; It seemed to succeed with&nbsp;<STRONG>fw monitor -pi 7&nbsp;</STRONG>which is still located inside the SecureXL sequences, but in reality it just stuffed the fwmonitor module at the equivalent of "i" (module #14) in the F2F path:</P> <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="chainstuff.png" style="width: 902px;"><img src="https://community.checkpoint.com/t5/image/serverpage/image-id/8616i03EAE4144EEBA0BA/image-size/large?v=v2&amp;px=999" role="button" title="chainstuff.png" alt="chainstuff.png" /></span></P> <P>So once again it is not possible to use the INSPECT filters in <STRONG>fw monitor</STRONG> with anything other than <STRONG>-e</STRONG>, and <STRONG>-F</STRONG> with its restrictive syntax must be used if traffic is not F2F.&nbsp; The lone exception seems to be <STRONG>fw monitor -p all</STRONG> (<EM>DON'T RUN THIS ON A PRODUCTION FIREWALL</EM>) which is somehow getting its hooks into the early SecureXL chain sequences on the Firewall Worker, but there doesn't seem to be any further granularity available for insertion points that early.</P> Sat, 24 Oct 2020 15:44:59 GMT Timothy_Hall 2020-10-24T15:44:59Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41546#M3423 <TABLE style="border: 1px solid #c6c6c6; border-collapse: separate; border-radius: 5px; background-color: #e15180; padding: 6px; text-indent: 10px;" width="100%"> <THEAD> <TR> <TH align="left"><FONT size="4" color="#ffffff">Introduction</FONT></TH> </TR> </THEAD> </TABLE> <P>This overview gives you an view of the changes in R80.20 fw monitor. All R80.10 and R80.20 changes are contained in this command overview (cheat sheet). You could download the cheat sheet at the end of this article as a PDF file. Unfortunately not all information for R80.20 is included in SK30583 "<A title="https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk30583&amp;partition=General&amp;product=Security" href="https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk30583&amp;partition=General&amp;product=Security" target="_blank" rel="noopener">What is FW Monitor?"</A>. Therefore this small overview with the changes. I hope it helps you.</P> <TABLE style="border: 1px solid #c6c6c6; border-collapse: separate; border-radius: 5px; background-color: #e15180; padding: 6px; text-indent: 10px;" width="100%"> <THEAD> <TR> <TH align="left"><FONT size="4" color="#ffffff">Cheat Sheet</FONT></TH> </TR> </THEAD> </TABLE> <P><IMG class="image-3 jive-image" src="https://community.checkpoint.com/legacyfs/online/checkpoint/77996_pastedImage_1.png" border="0" /></P> <P><IMG class="image-2 jive-image" src="https://community.checkpoint.com/legacyfs/online/checkpoint/77541_pastedImage_2.png" border="0" /></P> <TABLE style="border: 1px solid #c6c6c6; border-collapse: separate; border-radius: 5px; background-color: #e15180; padding: 6px; text-indent: 10px;" width="100%"> <THEAD> <TR> <TH align="left"><FONT size="4" color="#ffffff">Download</FONT></TH> </TR> </THEAD> </TABLE> <P><SPAN style="font-size: 10.0pt;">Download: <A href="https://www.ankenbrand24.de/wp-content/uploads/2019/12/Check-Point-FW-MONITOR-cheat-sheet-3.1d.pdf" target="_self" rel="nofollow noreferrer">R80.20 fw monitor cheat sheet PDF</A> (new R80.20 version)</SPAN></P> <TABLE style="border: 1px solid #c6c6c6; border-collapse: separate; border-radius: 5px; background-color: #e15180; padding: 6px; text-indent: 10px;" width="100%"> <THEAD> <TR> <TH align="left"><FONT size="4" color="#ffffff">Chapter</FONT></TH> </TR> </THEAD> </TABLE> <P><STRONG>More interesting articles:<BR /></STRONG><A href="https://community.checkpoint.com/t5/General-Topics/R80-x-Architecture-and-Performance-Tuning-Link-Collection/m-p/47883#M9336" target="_blank" rel="noopener" data-objecttype="102">- R80.x Architecture and Performance Tuning - Link Collection</A><BR /><A href="http://cp.ankenbrand24.de" target="_blank" rel="noopener nofollow noopener noreferrer noopener noreferrer">- Article list (Heiko Ankenbrand)</A><STRONG><BR />Cheat Sheet:</STRONG><BR /><A href="https://community.checkpoint.com/docs/DOC-3475-r8020-cheat-sheet-fw-monitor" target="_blank" rel="noopener" data-objecttype="102">- R80.x cheat sheet - fw monitor</A>&nbsp;<BR /><A href="https://community.checkpoint.com/docs/DOC-3741" target="_blank" rel="noopener">- R80.x cheat sheet - ClusterXL</A>&nbsp;</P> <P>&nbsp;</P> Mon, 16 Dec 2019 14:25:26 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41546#M3423 HeikoAnkenbrand 2019-12-16T14:25:26Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41547#M3424 <HTML><HEAD></HEAD><BODY><P>nice cheat sheet.</P></BODY></HTML> Mon, 21 Jan 2019 16:45:33 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41547#M3424 Vitaly_C_ 2019-01-21T16:45:33Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41548#M3425 <HTML><HEAD></HEAD><BODY><P>Hi&nbsp;<A href="https://community.checkpoint.com/migrated-users/55229">Heiko Ankenbrand</A>,</P><P></P><P>Is it correct that "fw accel off" at R80.20 no longer needs to be executed?</P><P></P><P>Kind regards</P><P>Aviel</P></BODY></HTML> Mon, 21 Jan 2019 19:32:23 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41548#M3425 Aviel_Ruijiling 2019-01-21T19:32:23Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41549#M3426 <HTML><HEAD></HEAD><BODY><P>Hi&nbsp; Aviel,</P><P></P><P>yes it is correct.</P><P></P><P>For more informations see <A href="https://community.checkpoint.com/docs/DOC-3351">R80.x Performance Tuning and Debug Tips – fw monitor.</A></P><P></P><P>Regards</P><P>Heiko</P></BODY></HTML> Mon, 21 Jan 2019 19:46:49 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41549#M3426 HeikoAnkenbrand 2019-01-21T19:46:49Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41550#M3427 <HTML><HEAD></HEAD><BODY><P>great work:-)</P></BODY></HTML> Mon, 21 Jan 2019 19:59:42 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41550#M3427 Andi_Schill 2019-01-21T19:59:42Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41551#M3428 <HTML><HEAD></HEAD><BODY><P class="">Nice Denglisch </P><P class="">„<I>Virtuelles System</I>“</P></BODY></HTML> Mon, 21 Jan 2019 22:08:18 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41551#M3428 Danny 2019-01-21T22:08:18Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41552#M3429 <HTML><HEAD></HEAD><BODY><P>I like this. Thanks!! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P></BODY></HTML> Tue, 22 Jan 2019 08:33:40 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41552#M3429 Nikolai_Borhart 2019-01-22T08:33:40Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41553#M3430 <HTML><HEAD></HEAD><BODY><P>Hi <A href="https://community.checkpoint.com/migrated-users/41735">Danny.</A></P><P></P><P>I translated my cheat sheets from German to English and overlooked two points.</P><P></P><P>THX</P><P>Heiko</P></BODY></HTML> Tue, 22 Jan 2019 09:10:05 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41553#M3430 HeikoAnkenbrand 2019-01-22T09:10:05Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41554#M3431 <HTML><HEAD></HEAD><BODY><P>thank you so much... Great job Mr. Heiko!!</P></BODY></HTML> Tue, 22 Jan 2019 13:37:43 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41554#M3431 Alessandro_Marr 2019-01-22T13:37:43Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41555#M3432 <HTML><HEAD></HEAD><BODY><P>Great job.</P></BODY></HTML> Tue, 22 Jan 2019 18:21:00 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41555#M3432 nicolas_strasch 2019-01-22T18:21:00Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41556#M3433 <HTML><HEAD></HEAD><BODY><P>Thank you!</P></BODY></HTML> Wed, 23 Jan 2019 10:26:38 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41556#M3433 Henrique_Sauer_ 2019-01-23T10:26:38Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41557#M3434 <HTML><HEAD></HEAD><BODY><P>Done!</P></BODY></HTML> Wed, 23 Jan 2019 10:54:34 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41557#M3434 HeikoAnkenbrand 2019-01-23T10:54:34Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41558#M3435 <HTML><HEAD></HEAD><BODY><P>Fantastic. Thank you</P></BODY></HTML> Thu, 24 Jan 2019 08:46:39 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41558#M3435 Mark_Mitchell 2019-01-24T08:46:39Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41559#M3436 <HTML><HEAD></HEAD><BODY><P><SPAN style="color: #333333; background-color: #ffffff;">I like this. Great job.</SPAN></P></BODY></HTML> Thu, 24 Jan 2019 18:44:40 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41559#M3436 Morris_Nelka 2019-01-24T18:44:40Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41560#M3437 <HTML><HEAD></HEAD><BODY><P><SPAN style="color: #333333; background-color: #ffffff;">Fantastic job.</SPAN></P></BODY></HTML> Tue, 29 Jan 2019 18:37:09 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41560#M3437 Bidwell_Britta 2019-01-29T18:37:09Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41561#M3438 <HTML><HEAD></HEAD><BODY><P>Great work!</P></BODY></HTML> Wed, 06 Feb 2019 15:32:53 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41561#M3438 Zoltan_Polowsky 2019-02-06T15:32:53Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41562#M3439 <HTML><HEAD></HEAD><BODY><P>I think some interesting macroses should be added, such as no_term, http, etc. Some more info here:&nbsp;<A class="link-titled" href="http://checkpoint-master-architect.blogspot.com/2017/01/using-fw-monitor-command-is-even-easier.html" title="http://checkpoint-master-architect.blogspot.com/2017/01/using-fw-monitor-command-is-even-easier.html">CCMA's blog: Using "fw monitor" command is even easier than you think</A>&nbsp;</P></BODY></HTML> Wed, 06 Feb 2019 17:44:06 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/41562#M3439 _Val_ 2019-02-06T17:44:06Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/47066#M3493 <P>Is it possible to adding more macros?</P> Fri, 15 Mar 2019 13:58:42 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/47066#M3493 Sergej_Dmitrije 2019-03-15T13:58:42Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/47067#M3494 <P>Is it possible to adding more macros?</P> Fri, 15 Mar 2019 13:59:43 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/47067#M3494 Sergej_Dmitrije 2019-03-15T13:59:43Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/47082#M3496 <P>Do you have more cheat sheets?</P> Fri, 15 Mar 2019 15:32:17 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/R80-20-cheat-sheet-fw-monitor/m-p/47082#M3496 Florian_Winterb 2019-03-15T15:32:17Z