topic Re: How to see what firewall rules match some traffic in General Topics

How to see what firewall rules match some traffic

Olga_Kuts — Fri, 21 Dec 2018 07:43:56 GMT

I need to see what firewall rules match some traffic. There are a lot of rules in my policy, accordingly, not all rules are logged. What kind of debug and which flags can I use for this purpose (except the flag "conn")? Or what method can I use for this purpose?

Re: How to see what firewall rules match some traffic

G_W_Albrecht — Fri, 21 Dec 2018 08:24:31 GMT

Maybe this helps: sk85780 - How to use the 'connstat' utility

Re: How to see what firewall rules match some traffic

Olga_Kuts — Fri, 21 Dec 2018 08:38:02 GMT

Unfortunately, no. Connstat we can use only for Windows. For Gaia we can use CPmonitor, but is not supported on a 64-bit based OS.

Re: How to see what firewall rules match some traffic

G_W_Albrecht — Fri, 21 Dec 2018 08:46:52 GMT

I do not understand - you can collect the table using

fw tab -t connections -u > /var/log/Connections_Table.txt

transfer it to the PC and run the utility with the relevant flags:

C:\> connStat.exe -f Name_of_Table_File.txt [-a|-c|-s|-r|-l|-p|-d|-n <number>] > Name_of_Output_File.txt

Also, CPMonitor 32bit limitation should not apply here.

Re: How to see what firewall rules match some traffic

Olga_Kuts — Fri, 21 Dec 2018 09:05:46 GMT

Thanks for explanation, but it does not suit me, unfortunately.

I need to see what rule number match traffic with specific dst and src address.

Re: How to see what firewall rules match some traffic

G_W_Albrecht — Fri, 21 Dec 2018 09:33:28 GMT

Now i understand! This is all in the used connections table, but you must analyze it yourself, see sk65133: Connections Table Format

Re: How to see what firewall rules match some traffic

JozkoMrkvicka — Fri, 21 Dec 2018 12:37:09 GMT

Not exactly what you want, but sort of

https://community.checkpoint.com/thread/5319-my-top-3-check-point-cli-commands#comment-14596

EDIT: Check this thread:

CPT - Check Point Packet Trace Utility ?

EDIT2:

And the winner is (hidden tool in R80):

fw up_execute

Re: How to see what firewall rules match some traffic

Olga_Kuts — Fri, 21 Dec 2018 13:08:28 GMT

fw up_execute is a winner, you are right)

Re: How to see what firewall rules match some traffic

RickHoppe — Sun, 23 Dec 2018 05:55:48 GMT

No need to go into CLI, you can use Packet Mode in SmartConsole R80.10+. See https://community.checkpoint.com/thread/5233-packet-mode-a-new-way-of-searching-through-your-security-policy-in-r8010

Re: How to see what firewall rules match some traffic

Alexander_Baue1 — Mon, 07 Jan 2019 08:12:35 GMT

Hello
The easy Way enable on Smart Console the Option Hit than you can see if the all the Policys are in use.
Alexander