topic At a gateway, how do I determine what domain the gateway belongs to? in General Topics

At a gateway, how do I determine what domain the gateway belongs to?

George_Ellis — Wed, 25 Jun 2025 13:54:50 GMT

Hi folks,

MDM Environment. How can I determine at the gateway where a policy was installed from? Even better, how can I determine the domain the gateway and policy belong to?

I tried finding a CLI command, MIB member, and even if I could find the name in logs or certificates. Has anyone figured this out?

TIA
George Ellis @ IHG

Re: At a gateway, how do I determine what domain the gateway belongs to?

Chris_Atkinson — Wed, 25 Jun 2025 14:10:08 GMT

You will get some clues from the following cmds:

netstat -an | grep 18192

cpstat fw

Re: At a gateway, how do I determine what domain the gateway belongs to?

George_Ellis — Wed, 25 Jun 2025 17:21:52 GMT

Netstat works to a degree as it list both MDMs. Not the preferred method as I will have to create a if/then to assign the domain name to a variable based on the last octet.

There are multiple ways to get the policy name either via snmpwalk or this method (which is what I use)
fw stat | awk '/localhost/ {print $2,$3}'

Bonus content: - Get the IP of the Log server.
cpstat fw -f log_connection |grep 'Log-Server Connected' | awk '{print $1}' | sed 's/|//g'
<Reply is IP>

cpstat fw -f log_connection |grep 'Log-Server Disconnected' | awk '{print $1}' | sed 's/|//g'

Re: At a gateway, how do I determine what domain the gateway belongs to?

the_rock — Wed, 25 Jun 2025 17:33:39 GMT

See if this helps.

Andy

https://community.checkpoint.com/t5/General-Topics/Policy-location-on-a-gateway-R80/td-p/46865

Re: At a gateway, how do I determine what domain the gateway belongs to?

the_rock — Wed, 25 Jun 2025 17:39:08 GMT

Maybe check below too.

Andy

cat $FWDIR/state/local/FW1/local.set | grep -i policy

Re: At a gateway, how do I determine what domain the gateway belongs to?

the_rock — Thu, 26 Jun 2025 01:14:55 GMT

Im pasting what you said in the other post from few years ago, will also try this in my R81.20 and R82 labs.

Andy

************************

Thanks guys for the directory suggestions (and the other replies)

I found the cheat code.

cat $FWDIR/state/local/FW1/local.sic_name |grep 'o='|awk -F ,o= '{print $2}'|awk -F . '{print $NR}'

Background
cat local.sic_name
sic_name=cn=<fwname>,o=<domainname>..<CAthingy>

Re: At a gateway, how do I determine what domain the gateway belongs to?

emmap — Thu, 26 Jun 2025 01:33:09 GMT

If you want to see the primary DMS name (and secondary if you have put it in the gateway under 'Fetch Policy') and the log servers, you can cat the masters file.

[Expert@EXLGW-s01-01:0]# cat /var/opt/CPsuite-R82/fw1/conf/masters
[Policy]
MgmtName
[Log]
MgmtName
[Alert]
MgmtName

Re: At a gateway, how do I determine what domain the gateway belongs to?

George_Ellis — Thu, 26 Jun 2025 12:57:16 GMT

That is even better. It helps with verifying other things like "is there a secondary log server" and "is the HA MDM defined".

[Policy]
MgmtName
MgmtNameHA
[Log]
MgmtMLMPrimary
[Alert]
MgmtMLMPrimary
[Backup]
MgmtMLMSecondary

Re: At a gateway, how do I determine what domain the gateway belongs to?

George_Ellis — Thu, 26 Jun 2025 13:11:21 GMT

emmap's solution is even better.

cat $FWDIR/conf/masters

I got lazy and asked grok to do it faster than I could type and verify...

cat $FWDIR/conf/masters | awk '/\[Policy\]/ {flag=1; next} /\[/{flag=0} flag' | tr '\n' ' ' | xargs
cat $FWDIR/conf/masters | awk '/\[Log\]/ {flag=1; next} /\[/{flag=0} flag' | head -n 1
cat $FWDIR/conf/masters | awk '/\[Backup\]/ {flag=1; next} /\[/{flag=0} flag' | head -n 1

Re: At a gateway, how do I determine what domain the gateway belongs to?

the_rock — Thu, 26 Jun 2025 13:17:26 GMT

Your command is great too, just tested in my lab.

Andy

[Expert@CP-FW-01:0]# cat $FWDIR/state/local/FW1/local.sic_name |grep 'o='|awk -F ,o= '{print $2}'|awk -F . '{print $NR}'
cp-management

[Expert@CP-FW-01:0]#

Re: At a gateway, how do I determine what domain the gateway belongs to?

George_Ellis — Thu, 26 Jun 2025 19:21:44 GMT

BONUS TIME.

We are worldwide with 13 CMAs. There is some mismatch of which firewalls are in which domain. So I am in the CLI and need to go to the SmartConsole CMA. If I don't remember where it resides, go to the MDM SC, click on GATEWAYS and SERVERS, look it up.

Oh, this is easy
"cat $FWDIR/conf/masters"

Ah, so open that CMA.