topic Re: CLI diagnostic commands in General Topics

CLI diagnostic commands

Matlu — Mon, 07 Aug 2023 17:03:22 GMT

Hello, everybody.

A question, is there any command in the CLI of my GW, that helps me with the NAT?

I mean, I have services that we publish to the Internet, which is using NAT (So they can access from the Internet), but we want a command to help us to see the translations from the CLI.

Is this possible?

In addition to this, we are starting to use the command
"fw tab -t connections -s" command, in order to be able to check the current and active connections through the GW.

But we have a doubt, is the PEAK column, the one that "tells" us how many connections there are through the GW?
Or is it some other column?

Thanks and greetings.

Re: CLI diagnostic commands

the_rock — Mon, 07 Aug 2023 22:45:39 GMT

You can check via show configuration or show nat-rules

Re: CLI diagnostic commands

Matlu — Mon, 07 Aug 2023 23:46:19 GMT

Bro,

But is there any command that tells me the NAT list that the GW is translating?

In cisco there is a command like "show ip nat translation", that helps to see the translation in real time.

In Checkpoint, is there this option?

Greetings.

Re: CLI diagnostic commands

the_rock — Mon, 07 Aug 2023 23:55:36 GMT

Will check tomorrow, not 100% sure.

Andy

Re: CLI diagnostic commands

the_rock — Tue, 08 Aug 2023 02:32:01 GMT

Hey bro,

Found below, but not sure if its useful to you.

Andy

Btw, I checked config for nat, but no such command on CP, similar to what you showed in Cisco.

https://community.checkpoint.com/t5/Management/What-is-the-command-to-check-NAT-from-CLI-of-CheckPoint-Firewall/td-p/86250

https://community.checkpoint.com/t5/Security-Gateways/NAT-Rules-and-fw-tab/td-p/16398

Re: CLI diagnostic commands

G_W_Albrecht — Tue, 08 Aug 2023 06:09:19 GMT

show configuration does not list anything about NAT and show nat-rules does not exist on my R81.10. cpview shows the NATed connections:

But that is not what the user wants to see, i fear!

Re: CLI diagnostic commands

G_W_Albrecht — Tue, 08 Aug 2023 06:10:42 GMT

As the name implies, #VALS shows current number, #PEAK the peak number (since last reboot ?)

Re: CLI diagnostic commands

the_rock — Tue, 08 Aug 2023 12:25:20 GMT

Yes sir Guenther, agree 100% 🙂