topic Adding an entry to the connections table in General Topics

Adding an entry to the connections table

kamilazat — Fri, 12 Jul 2024 12:53:09 GMT

Hi all!

In the R81.20 CLI Reference Guide, under fw tab section it shows this:

-a -e "<Entry>"

Adds the specified entry to the specified kernel table.

If a kernel table has the expire attribute, when you add an entry with the "-a -e <Entry>" parameter, the new entry gets the default table timeout.

You can use this parameter only on the local Security Gateway.

Warning - If you add a wrong entry, you can make your Security Gateway unresponsive.

I tried adding an entry in different formats in my lab, but every time the gateway became unresponsive (as warned). Now I have questions:

1. What is the 'right' entry that will not render the GW unresponsive? I used the 5-tuple format as stated in sk65133 to no avail.

2. Does connections table have an expire attribute? If yes where can I learn more about it?

Thanks as always!

Re: Adding an entry to the connections table

the_rock — Fri, 12 Jul 2024 13:18:51 GMT

Can you send an example you used? Happy to try in my lab.

Andy

Re: Adding an entry to the connections table

PhoneBoy — Fri, 12 Jul 2024 18:52:05 GMT

An exact example of what you tried would be helpful.
Having said that, adding or removing connection table entries from a live gateway is dangerous at best and not recommend.
Can you provide more details around WHY you are attempting to do this?

Re: Adding an entry to the connections table

kamilazat — Mon, 15 Jul 2024 07:09:19 GMT

Thank you for the inquiries.

I found out that it was possible while looking up potential solutions to "resurrecting" a connection back into connections table (as mentioned by Tim Hall in this post) for a customer. I found out in the documentation that it actually is possible to add an entry to kernel tables. So I started playing in my dummy lab.
What I tried is to blindly add a connection entry using the 5-tuple format (from sk65133). And, of course, it rendered the gateway unresponsive and I had to revert to the previous snapshot.

We have opened a TAC case to troubleshoot the issue at hand. But since I started playing with connections table in a completely destroyable lab, I wanted to learn more about how it works and the reasons I'm failing in this. Maybe manually adding an entry is not possible in terms of connections table?

Re: Adding an entry to the connections table

PhoneBoy — Mon, 15 Jul 2024 18:08:16 GMT

Note that a given connection flowing through the gateway can have FOUR entries, particularly if NAT is involved.
There are entries in other tables that may need to be added/modified as well.

Re: Adding an entry to the connections table

kamilazat — Tue, 16 Jul 2024 07:08:28 GMT

I see, thank you very much for your answer. NAT is involved in that lab. So if I wanted to add an entry to connections table, I would have to simultaneously add entries to other tables, such as fwx_alloc_global, fwx_cache etc.

Is there a resource I can study the details of these tables, like I can for connections table?

Re: Adding an entry to the connections table

PhoneBoy — Tue, 16 Jul 2024 13:52:18 GMT

Not that I’m aware of, unfortunately.
Some of these tables have changed with versions.

If this is something that happens with a specific connection regularly, you might want to exempt it from state checking instead.
This way, you don’t have to manually try and patch it into the connections table(s).
See: https://support.checkpoint.com/results/sk/sk11088