topic Re: Can u explain the impact of using fw stop and cp stop ? in General Topics

Can you explain the impact of using fwstop and cpstop ?

Rajesh_P — Wed, 23 Jan 2019 21:03:58 GMT

Can u explain the impact of using fwstop and cpstop ?

Re: Can u explain the impact of using fw stop and cp stop ?

Matt_Ricketts — Thu, 24 Jan 2019 05:11:50 GMT

I haven't ever issued the command 'fw stop' but I can tell you that 'cp stop' will stop all of the Check Point processes and daemons. I have done 'ev stop' many times before, so I would have to guess that 'fw stop' will stop the Firewall processes while leaving the others running.

Basically, the impact of either command will stop the inspecting and passing of traffic on a security gateway. On a management server, 'fw stop' should have no impact since there are no Firewall services running there.

Re: Can u explain the impact of using fw stop and cp stop ?

G_W_Albrecht — Thu, 24 Jan 2019 08:49:27 GMT

[Expert@GW_80.20:0]# fwstop
VPN-1 & FireWall-1 was not stopped.
Run cpstop to stop all Check Point products.

/opt/CPsuite-R80.20/fw1/bin/fwstop

# Usage: fwstop -f [-proc | -default | -driver | -all]
#
# -f: needed in order to run fwstop, otherwise will not run
# -default: does not uninstall the kernel, instead loads default filter
# -proc: kill only user-mode processes
#
# in Linux:
# by default the kernel module is not unloaded. -driver unloads it.
# this is not supported. use at your own risk 😉

Re: Can u explain the impact of using fw stop and cp stop ?

Rajesh_P — Thu, 24 Jan 2019 13:46:31 GMT

thats great. so fw stop wont stop traffic procesing. r u able to pass traffic after executing fw stop. And on what scenario we wil do this ?

Re: Can u explain the impact of using fw stop and cp stop ?

Rajesh_P — Thu, 24 Jan 2019 13:48:59 GMT

Ok. thanks.. i am wondering for SIC reset the complete firewall services will be stopped right ? So Sic reset becomes random for sites, whether the network also will go down while 'cp stop' comes into picture automatically followed by sic resets ?

Re: Can u explain the impact of using fw stop and cp stop ?

G_W_Albrecht — Thu, 24 Jan 2019 14:12:59 GMT

I have to stress the point that the syntax is fwstop / cpstop 😉

As i wrote fwstop will kill processes and unload drivers. You can learnabout it in detail by studying this script. The same istrue of cpstart - /pfrm2.0/opt/fw1/bin/cpstart is a commented script that calls commands and other scripts.

Re: Can u explain the impact of using fw stop and cp stop ?

G_W_Albrecht — Thu, 24 Jan 2019 14:16:42 GMT

See sk86521: Reset SIC without restarting the firewall process - on SMB, you have to use cpstop / cpstart (or test if fw_configload also does the job...).

Re: Can u explain the impact of using fw stop and cp stop ?

AlekseiShelepov — Thu, 24 Jan 2019 14:22:25 GMT

fwstop command should stop firewall module ("VPN-1 & FireWall-1"). It means that traffic will not be passed through a gateway. You might use it when you have a standalone environment and want to stop only firewall, but not management part.

cpstop command stops all Check Point processes on a device.

Re: Can u explain the impact of using fw stop and cp stop ?

G_W_Albrecht — Thu, 24 Jan 2019 14:26:58 GMT

That is not fully true as you can read in the fwstop script - issuing "fwstop" will just display a message that explains you have to use it with parameters that guide what it really does only 😉

Re: Can you explain the impact of using fwstop and cpstop ?

PhoneBoy — Sat, 26 Jan 2019 19:23:59 GMT

fwstop is a legacy command that predates FireWall-1 NG (R5x).

In general, you should use cpstop, which does the following:

Does an orderly shutdown of all Check Point-related processes
Disables IP Forwarding
Unloads the Access Control and Threat Prevention policies from the kernel module

Re: Can you explain the impact of using fwstop and cpstop ?

Rajesh_P — Sat, 26 Jan 2019 20:27:56 GMT

thats cool.