topic Re: Manual transfer policy from SMS to GW in General Topics

Manual transfer policy from SMS to GW

Andrey_Gl — Tue, 25 Jul 2023 15:54:59 GMT

Hello!

I have many gateways on my SMS, including a remote gateway that currently has no network connectivity until I set a policy on it. However, I cannot set the policy because of this issue. Can you please advise if there is a way to manually extract the policy file from the SMS and place it onto the gateway, then restart the gateway to install from local policy file?

Re: Manual transfer policy from SMS to GW

Tal_Paz-Fridman — Wed, 26 Jul 2023 09:09:39 GMT

The Security Gateway does have a policy installed before it is connected to the Security Management Server called "Initial Policy":

https://sc1.checkpoint.com/documents/R81.20/WebAdminGuides/EN/CP_R81.20_Installation_and_Upgrade_Guide/Content/Topics-IUG/The-Initial-Policy.htm

Re: Manual transfer policy from SMS to GW

G_W_Albrecht — Wed, 26 Jul 2023 09:24:20 GMT

Assuming that the GW has internet connectivity and the current policy enables no access to it, this may be resolved by issuing fw unloadlocal from GW CLI, see https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_CLI_ReferenceGuide/Topics-CLIG/FWG/fw-unloadlocal.htm

Re: Manual transfer policy from SMS to GW

Andrey_Gl — Wed, 26 Jul 2023 09:56:43 GMT

The gateway is only accessible through VPN, but VPN cannot be established because the gateway is not aware of it. A policy needs to be installed instead of removing it.

Re: Manual transfer policy from SMS to GW

Tal_Paz-Fridman — Wed, 26 Jul 2023 10:15:17 GMT

There's still something not clear here. How can it be accessible through VPN when it is still not connected to the Security Management Server and part of a VPN Community?

The first connection to it is always SIC which requires direct connectivity to the Security Gateway.

Re: Manual transfer policy from SMS to GW

the_rock — Wed, 26 Jul 2023 11:53:09 GMT

You could attempt something like below via api, but no guarantee it will work, if SIC is not even established (im just guessing here, as I dont have all the details)

Andy

https://sc1.checkpoint.com/documents/latest/APIs/#cli/install-policy~v1.9%20

Examples

install-policy

Command

mgmt_cli install-policy policy-package "standard" access true threat-prevention true targets.1 "corporate-gateway"  --format json
 • "--format json" is optional. By default the output is presented in plain text.

Re: Manual transfer policy from SMS to GW

PhoneBoy — Wed, 26 Jul 2023 14:19:12 GMT

SIC will not go through VPN by default.
The reason for this is simple: if the VPN is down, you will be unable to manage the gateway.
Which is the precise situation you have here.
You will need to get SIC working without VPN first.
Without that, this will never work.

The following thread provides some pointers on managing a gateway over a VPN with SIC:
https://community.checkpoint.com/t5/Management/Managing-a-gateway-over-VPN/m-p/13674/highlight/true#M2423