topic Re: Unable to export Checkpoint firewall rulebase in General Topics

Unable to export Checkpoint firewall rulebase

nilanjan_lahiri — Mon, 22 Sep 2025 10:20:15 GMT

Hello All,

I am trying to export the Checkpoint firewall rulebase, however, getting the following error :-

[Expert@HAL-VPN-FW1:0]# $MDS_FWDIR/scripts/web_api_show_package.sh
Script stopped running due to severe error!
Result file location: show_package-2025-09-22_10-09-14.tar.gz

The generated file is just 4/5 lines and doesn't show the expected output.

[Expert@HAL-VPN-FW1:0]# mgmt_cli show access-rulebase
Username: admin
Password:
Couldn't connect to server
If you need to use a proxy server, add the '--proxy' parameter
[Expert@HAL-VPN-FW1:0]#

Please could you help to resolve this issue.

Thank You,

Nilanjan

Re: Unable to export Checkpoint firewall rulebase

Danny — Tue, 23 Sep 2025 15:52:37 GMT

The hostname indicates that you are trying to run this on the firewall gateway while those commands are meant to be run on the firewall management.

Re: Unable to export Checkpoint firewall rulebase

the_rock — Tue, 23 Sep 2025 17:13:46 GMT

That was the first thing I noticed what @Danny mentioned, just run fwm ver and see what it gives, if it does not work, then 100% you are on the gateway and NOT mgmt server.

Anddy

Re: Unable to export Checkpoint firewall rulebase

the_rock — Tue, 23 Sep 2025 17:16:51 GMT

Here is the proof from my lab.

Andy

*********************************

[Expert@CP-FW-01:0]# fwm ver
This is not a Security Management Server station.
[Expert@CP-FW-01:0]#

[Expert@CP-MANAGEMENT:0]# fwm ver
This is Check Point Security Management Server R82 - Build 007
[Expert@CP-MANAGEMENT:0]#

[Expert@CP-MANAGEMENT:0]# $MDS_FWDIR/scripts/web_api_show_package.sh
Script finished running successfully!
Result file location: show_package-2025-09-23_13-15-50.tar.gz
[Expert@CP-MANAGEMENT:0]# ls -lh show_package-2025-09-23_13-15-50.tar.gz
-rw-rw---- 1 admin root 367K Sep 23 13:16 show_package-2025-09-23_13-15-50.tar.gz
[Expert@CP-MANAGEMENT:0]# pwd
/home/admin
[Expert@CP-MANAGEMENT:0]#

Re: Unable to export Checkpoint firewall rulebase

the_rock — Tue, 23 Sep 2025 17:21:42 GMT

Here is example of what it would look like (again, just my lab, but you get an idea, this is when you extract the file it generates)

Andy

Re: Unable to export Checkpoint firewall rulebase

nilanjan_lahiri — Tue, 23 Sep 2025 18:56:12 GMT

Thank you for responding on this. I am trying to export the rule from the Management only. Please refer to the output below :-

[Expert@HAL-VPN-FW1:0]# fwm ver
This is Check Point Security Management Server R80.40 - Build 039
[Expert@HAL-VPN-FW1:0]# $MDS_FWDIR/scripts/web_api_show_package.sh
Script stopped running due to severe error!
Result file location: show_package-2025-09-23_19-18-33.tar.gz

Please could you help...

Re: Unable to export Checkpoint firewall rulebase

the_rock — Tue, 23 Sep 2025 18:57:14 GMT

Of course we can help and we will help, thats what we do here!

Anywho, if I were you, since its management, just try either cprestart and see if that works, but if not, just do a quick reboot.

Andy

Re: Unable to export Checkpoint firewall rulebase

nilanjan_lahiri — Tue, 23 Sep 2025 20:17:59 GMT

Neither cprestart, nor reboot helped me to resolve the issue. Could it be due to cluster issue? Is there any way that could be checked.

Thanks !

Re: Unable to export Checkpoint firewall rulebase

the_rock — Tue, 23 Sep 2025 20:53:43 GMT

its management ha?

Re: Unable to export Checkpoint firewall rulebase

nilanjan_lahiri — Mon, 06 Oct 2025 11:30:48 GMT

Apologies for not being able to respond earlier. Could you please help how to validate the Management HA. I am getting the following output while running the below command :-

HAL-VPN-FW1> cphaprob -a if

CCP mode: Manual (Unicast)
Required interfaces: 3
Required secured interfaces: 1

Interface Name: Status:

eth1 UP
eth2 UP
Sync (S) UP
Mgmt Non-Monitored

S - sync, LM - link monitor, HA/LS - bond type

Virtual cluster interfaces: 2

eth1 81.x.x.x
eth2 22.x.x.x

Re: Unable to export Checkpoint firewall rulebase

the_rock — Mon, 06 Oct 2025 11:35:09 GMT

Lets clarify some things, so its all clear 100%. Since you are trying to do this on mgmt, cphaprob -a if command is ONLY valid on the firewall, it would never work on management itself, unless it was full HA, which it does not sound like it would be in your case, but please correct me if Im mistaken.

Secondly, can you run fwm ver command from that same prompt? To me, that 100% looks like its fw itself, NOT mgmt server.

Andy

Re: Unable to export Checkpoint firewall rulebase

nilanjan_lahiri — Mon, 06 Oct 2025 11:41:00 GMT

I am getting the following output :-

HAL-VPN-FW1> fwm ver
This is Check Point Security Management Server R80.40 - Build 039

Re: Unable to export Checkpoint firewall rulebase

the_rock — Mon, 06 Oct 2025 11:43:11 GMT

Guess I was mistaken, does appear you have 2 standalones in a cluster, aka Full HA config. What does cpstat mg command show?

From my lab:

[Expert@CP-MANAGEMENT:0]# cpstat mg

Product Name: Check Point Security Management Server
Major version: 6
Minor version: 0
Build number: 998000007
Is started: 1
Active status: active
ICA status: 0
Status: The Internal Certificate Authority (ICA) certificate is valid until Jan 19 03:14:07 2038 GMT

[Expert@CP-MANAGEMENT:0]#

Re: Unable to export Checkpoint firewall rulebase

the_rock — Mon, 06 Oct 2025 11:43:47 GMT

@nilanjan_lahiri If you allow remote session, let me know, I will message you offline, we can do zoom.

Let me know.

Best,

Andy

Re: Unable to export Checkpoint firewall rulebase

nilanjan_lahiri — Mon, 06 Oct 2025 11:48:44 GMT

Below is the output. I will surely try for a remote session, will update you accordingly. Thanks @the_rock

[Expert@HAL-VPN-FW1:0]# cpstat mg

Product Name: Check Point Security Management Server
Major version: 6
Minor version: 0
Build number: 994000039
Is started: 1
Active status: active
Status: OK

Re: Unable to export Checkpoint firewall rulebase

the_rock — Mon, 06 Oct 2025 11:51:50 GMT

Looks right to me. So if you run below, still fails?

$MDS_FWDIR/scripts/web_api_show_package.sh

If so, just go to scripts dir and run chmod 777 * and try again.

Andy

Re: Unable to export Checkpoint firewall rulebase

nilanjan_lahiri — Mon, 06 Oct 2025 11:52:32 GMT

Yes, it still fails... Please see below :-

[Expert@HAL-VPN-FW1:0]# $MDS_FWDIR/scripts/web_api_show_package.sh
Script stopped running due to severe error!
Result file location: show_package-2025-10-06_12-19-19.tar.gz
[Expert@HAL-VPN-FW1:0]#

Re: Unable to export Checkpoint firewall rulebase

the_rock — Mon, 06 Oct 2025 11:54:13 GMT

Just message me directly if you can do remote.

Best,

Andy