topic Re: "Command to check which policy set is installed on a Gateway or cluster." in API / CLI Discussion

"Command to check which policy set is installed on a Gateway or cluster."

SecdetKrypton — Tue, 18 Feb 2025 00:58:09 GMT

I want to know the command to check which policy set is installed on a gateway and how to revert the incorrect policy installation on the wrong gateway.

Re: "Command to check which policy set is installed on a Gateway or cluster."

the_rock — Tue, 18 Feb 2025 01:05:58 GMT

https://sc1.checkpoint.com/documents/latest/APIs/?#cli/install-policy~v2%20

If you have expert mode, just run fw stat to see which policy is currently installed, or if threat prevention is also active, then fw stat -b AMW. To revert, if you have access to smart console, you can install it from there, but if not, then you need to use mgmt_cli

Andy

Re: "Command to check which policy set is installed on a Gateway or cluster."

AkosBakos — Tue, 18 Feb 2025 08:25:50 GMT

Hi,

Totally agree with @the_rock, but if you not a CLI expert, just learn this command: cpview

Re: "Command to check which policy set is installed on a Gateway or cluster."

Timothy_Hall — Tue, 18 Feb 2025 20:35:28 GMT

Normally you would reinstall the correct policy to the gateway from the SmartConsole as the_rock said. However if you can't do that for some reason, starting in R81.20 Jumbo 54+ and R82 the gateway itself will cache the last two policies installed prior to the current one. These can be reinstalled right from the gateway itself using policy_rev_tool: sk181437: Access Control Policy Revert Tool (policy_rev_tool)

This is one of the tips in my upcoming CPX Vegas presentation.

Re: "Command to check which policy set is installed on a Gateway or cluster."

Lesley — Tue, 18 Feb 2025 21:32:17 GMT

Only thing i would like to add, if for some reason you cannot re-install the correct policy. You might need to run:

fw unloadlocal

Description

Uninstalls all policies from the Security Gateway or Cluster Member.

Warning:

The "fw unloadlocal" command prevents all traffic from passing through the Security Gateway (Cluster Member), because it disables the IP Forwarding in the Linux kernel on the Security Gateway (Cluster Member).
The "fw unloadlocal" command removes all policies from the Security Gateway (Cluster Member). This means that the Security Gateway (Cluster Member) accepts all incoming connections destined to all active interfaces without any filtering or protection enabled.