topic Re: cpstat confusion about the documentation in General Topics

cpstat confusion about the documentation

Yuri_Slobodyany — Wed, 01 Dec 2021 10:38:23 GMT

Good day everyone,

I am trying to get to know cpstat command better and find that flags/flavors listed in the CLI Reference (R80.40/R81) do not work quite a lot. Is there something missing on the gateways/SMS I am trying this command out (installed-wise) or is it by intention (documented but not implemented)?

E.g.:

[Expert@R81-standalone:0]# cpstat -f default ips No product has flag 'ips' [Expert@R81-standalone:0]# cpstat blades -f av Invalid flavour 'av' for product 'blades'. Use 'cpstat' without any arguments to see supported products and flavours.

Of course, all those flags/flavors appear as valid in the documentation and I have all blades enabled on this standalone open server.

Thanks

Reference:

- https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_CLI_ReferenceGuide/Topics-CLIG/SECMG/cpstat.htm

- SK: Tried quite hard to find an SK for this tool to no avail, would be great if someone could point me to one.

Re: cpstat confusion about the documentation

_Val_ — Wed, 01 Dec 2021 11:33:26 GMT

The reference is not exactly matching your version, use https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_CLI_ReferenceGuide/Topics-CLIG/SECMG/cpstat.htm?Highlight=cpstat

Also, flavors are not required to see IPS. Did you try without "-f default"?

Re: cpstat confusion about the documentation

Yuri_Slobodyany — Wed, 01 Dec 2021 11:41:24 GMT

Nope:

[Expert@R81-standalone:0]# cpstat ips
No product has flag 'ips'

And those are enabled blades:

[Expert@R81-standalone:0]# enabled_blades
fw vpn cvpn urlf av appi ips anti_bot qos mon
[Expert@R81-standalone:0]#

Yes, I meant R81 has the same flags as R80.40 with the same errors when trying to use them.

Re: cpstat confusion about the documentation

_Val_ — Wed, 01 Dec 2021 11:40:34 GMT

Please run "cpstat blades" and show the output

Re: cpstat confusion about the documentation

_Val_ — Wed, 01 Dec 2021 11:42:17 GMT

Also, just "cpstat" without anything else

Re: cpstat confusion about the documentation

Yuri_Slobodyany — Wed, 01 Dec 2021 11:43:19 GMT

[Expert@R81-standalone:0]# cpstat blades

Packets accepted : 923861
Packets dropped : 9471
Peak number of connections: 537
Number of connections: 19

Top Rule Hits
-----------------------
|rule index|rule count|
-----------------------
-----------------------

Note: This is a lab setup, not production gateway so not much rules/hits seen above.

Re: cpstat confusion about the documentation

_Val_ — Wed, 01 Dec 2021 11:45:50 GMT

Okay, I believe it should be "cpstat -f ips blades"

Re: cpstat confusion about the documentation

_Val_ — Wed, 01 Dec 2021 11:56:57 GMT

As I mentioned already, it should be:

cpstat -f ips blades

cpstat -f av blades

Does it work for you this way?

cpstat without any input should show you all options

Re: cpstat confusion about the documentation

Yuri_Slobodyany — Wed, 01 Dec 2021 12:31:39 GMT

Got it now - thanks. Each gateway differs in output of cpstat , not sure how - even on production servers with the same blades enabled the options differ. The reference about this - "Note - The available flags depend on the enabled Software Blades. Some flags are supported only by a Security Gateway, and some flags are supported only by a Management Server." Even though, gateways where e.g. cpstat ips does work, do not accept -f default to it (as per reference should). So the bottom line is NOT to reference the documentation (I guess it is just a dump of ALL possible options on ALL possible gateways, including SMB/VSX/Crossbeam/etc), but reference output of the cpstat on a particular server, then move on from there.

Thanks again,
case closed.

Re: cpstat confusion about the documentation

_Val_ — Wed, 01 Dec 2021 12:31:16 GMT

You are welcome.

I do agree that the notion of flags and flavours is a bit odd here, especially considering flavors depend on flags but are called before those in the CLI command 🙂 But this is not a documentation issue, and with a minimal effort, it all clicks into place.

Re: cpstat confusion about the documentation

the_rock — Wed, 01 Dec 2021 13:01:39 GMT

I agree with @_Val_ . I always just run cpstat without any flags and it will show you all available options, for sure.

Here is what I see on R81.10 gateway:

Available application_flags:

Then I ran cpstat blades -f ips and got below:

cpstat blades -f ips
Invalid flavour 'ips' for product 'blades'. Use 'cpstat' without any arguments to see supported products and flavours.

Also tried what Val suggested cpstat -f ips blades, but same issue.

Its possible that certain flags dont work right, not sure.