topic Re: Want to export object , policy file from checkpoint R77.30 in Firewall and Security Management

Want to export object , policy file from checkpoint R77.30

deepakk — Sun, 12 Jan 2020 15:52:44 GMT

Hi ,

We are managing 10 context (virtual firewalls) on single physical firewall 4800 in Active-active mode. We are trying to check object list , policies , routes of individual firewall or complete MDS but failed to collect.

Tried to export Objects_5_0.C file(From MDM) but it is showing only 9000 address object which has shared/global objects. local firewall objects are not showing
Tried to export Objects_5_0.C fil but address object count is not correct

Checked below paths but backup neither showing for individual context nor for complete Firewall

1. Objects_5_0.C - found this on: /opt/CPsuite-R77/fw1/conf
2. Rulebases_5_0.fws - found this on: /opt/CPsuite-R77/fw1/conf
3. PolicyName.W - a file with extension .W”, the filename takes the policy’s name (by default Standard.W). Those files are stored in the SmartCenter (Management) under “$FWDIR/conf”

Please suggest. Thanks in advance

Re: Want to export object , policy file from checkpoint R77.30

PhoneBoy — Mon, 13 Jan 2020 05:26:53 GMT

When using multi-domain with global objects, there is no one "single source" for objects in use on a given domain.
It is a combination of global objects and local objects, which are in two different databases, as you pointed out.
I believe a combined version MAY be pushed to $FWDIR/state for the various VSes.
However, not having a VSX gateway handy, I'm not sure exactly what that directory looks like, which will surely be different than a non-VSX gateway.

Re: Want to export object , policy file from checkpoint R77.30

Maarten_Sjouw — Mon, 13 Jan 2020 06:14:35 GMT

Looks like you were only looking at the global level?
Did you look at the different objects_5_0.C in each domain?
You can see the domainlist with mdsstat and go to each domain with mdsenv <IP> or mdsenv <CMA-name>
Then check the $FWDIR/conf which converts to:
/opt/CPmds-R77/customers/<CMA-Name>/CPsuite-R77/fw1/conf

Re: Want to export object , policy file from checkpoint R77.30

deepakk — Sat, 18 Jan 2020 10:43:09 GMT

Thank you very much Maarten.
"/opt/CPmds-R77/customers/<CMA-Name>/CPsuite-R77/fw1/conf " in this path now I am able to get object , policies for individual context.

Is it possible to collect a single file which include object of all context ? , policies of all context ?
or Single MDM backup including all context ?

Re: Want to export object , policy file from checkpoint R77.30

FraP — Sat, 18 Jan 2020 11:38:45 GMT

for this kind of assestment i think this could help you a bit: sk64501
(no routes export with this tool)

then you need to manipolate the output as you need

Re: Want to export object , policy file from checkpoint R77.30

Maarten_Sjouw — Sat, 18 Jan 2020 13:25:43 GMT

Also there the same applies, you need to run it per CMA.
There is no way to get it all in one go, so just create a script that will loop through all domains and create a index HTML file to summarize all policies.