topic Re: rulebase / policy export from enforcement gateway in General Topics

rulebase / policy export from enforcement gateway

ekagan — Fri, 28 Jun 2019 00:05:29 GMT

Hi there,

Couldn't find anything similar, so here it goes.

I need to integrate Checkpoint firewalls into an existing scripted solution. The requirement is to export the entire policy / rulebase / object definitions in human or machine readable form. But there's a catch. I only have access to the gateways and not to the management server. Any ideas? Version is R77.30.

Thanks,

Eli

Re: rulebase / policy export from enforcement gateway

PhoneBoy — Fri, 28 Jun 2019 18:17:54 GMT

If it's at all possible to get access to the management station, this will make the task significantly easier.
What is stored on the gateways is in compiled form in $FWDIR/state/local/FW1.
We do not have a documented process or tools outside of Professional Services to recover the data from these directories.

Re: rulebase / policy export from enforcement gateway

ekagan — Fri, 28 Jun 2019 22:13:06 GMT

What about file is $FWDIR/database directory? They sort of look like my policy?

Re: rulebase / policy export from enforcement gateway

PhoneBoy — Sat, 29 Jun 2019 00:11:52 GMT

There is definitely some stuff in there as well.
There's an SK that talks about clearing both directories in case of some corruption: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk33328

Between $FWDIR/database and $FWDIR/state/local/FW1, you may be able to recover what you need.

Re: rulebase / policy export from enforcement gateway

_Val_ — Sat, 29 Jun 2019 19:31:26 GMT

either way, you cannot convert compiled policies into human readable form without very hard effort. get access to the management station for that.

Re: rulebase / policy export from enforcement gateway

HeikoAnkenbrand — Sun, 30 Jun 2019 18:44:50 GMT

@ekagan you write:

CUT>>>

I only have access to the gateways and not to the management server. Any ideas?

<<<CUT

Why don't you have access to management? Is it a password problem or is the server damaged?

If it is a password problem you can reset the GAIA password and then set a new console password with "cpconfig".

Re: rulebase / policy export from enforcement gateway

ekagan — Mon, 01 Jul 2019 20:47:31 GMT

My scripting host doesn't have access... I do.