topic Re: R80.20 - new interesting commands in General Topics

R80.20 - new interesting commands

HeikoAnkenbrand — Wed, 20 Mar 2019 20:17:12 GMT

I've been testing R80.20 very intensively in the lab over the last few days. Here I have discovered some interesting new commands on CLI. What did you discover that didn't exist before?

# cphaprob stat > with more clusterxl informations

# fwaccel ranges > show's anti spoofing ranges

# fw ctl multik utilize > shows the CoreXL queue utilization for each CoreXL FW instance

# fw ctl multik print_heavy_conn > shows the table with heavy connections

More see:

Command Line Interface R80.20 Reference Guide

Re: R80.20 - new interesting commands

HeikoAnkenbrand — Fri, 28 Sep 2018 14:42:23 GMT

See more: R80.20 - more ClusterXL state informations

# cphaprob stat

Regards,

Heiko

Re: R80.20 - new interesting commands

HeikoAnkenbrand — Fri, 28 Sep 2018 14:48:34 GMT

Exciting command show's anti spoofing ranges:-)

You have to take a closer look.

# fwaccel ranges

Regards,

Heiko

Re: R80.20 - new interesting commands

HeikoAnkenbrand — Sat, 29 Sep 2018 19:50:14 GMT

Shows the CoreXL queue utilization for each CoreXL FW instance

# fw ctl multik utilize

Re: R80.20 - new interesting commands

HeikoAnkenbrand — Sat, 29 Sep 2018 20:04:26 GMT

Shows the table with Heavy Connections (that consume the most CPU resources) in the CoreXL

Dynamic Dispatcher.

# fw ctl multik print_heavy_conn

Re: R80.20 - new interesting commands

Ofir_Shikolski — Sun, 30 Sep 2018 13:05:30 GMT

fw ctl multik stop / start

Re: R80.20 - new interesting commands

HeikoAnkenbrand — Mon, 01 Oct 2018 14:39:59 GMT

The blacklist blocks all traffic to and from the specified IP addresses.

The blacklist drops occur in SecureXL, which is more efficient than an Access Control Policy to drop the packets.

This can be very helpful e.g. with DoS attacks to block an IP on SecureXL level.

# fwaccel dos blacklist -a <ip>

# fwaccel dos blacklist -s

# fwaccel dos blacklist -d <ip>

More see here:

R80.20 - IP blacklist in SecureXL

Regards,

Heiko

Re: R80.20 - new interesting commands

HeikoAnkenbrand — Mon, 15 Oct 2018 20:53:28 GMT

# fw ctl chain

The new fw monitor chain modules (SecureXL) do not run in the virtual machine (vm):

SecureXL inbound (sxl_in) > Packet received in SecureXL from network

SecureXL inbound CT (sxl_ct) > Accelerated packets moved from inbound to outbound processing (post routing)

SecureXL outbound (sxl_out) > Accelerated packet starts outbound processing

SecureXL deliver (sxl_deliver) > SecureXL transmits accelerated packet

Re: R80.20 - new interesting commands

HeikoAnkenbrand — Mon, 15 Oct 2018 20:57:33 GMT

In firewall kernel (now also SecureXL), each kernel is associated with a key (blue) witch specifies the type of traffic applicable to the chain modul.

# fw ctl chain

# fw monitor -e ...

Key	Function
ffffffff	IP Option Stip/Restore
00000001	new processed flows
00000002	wire mode
00000003	will applied to all ciphered traffic (VPN)
00000000	SecureXL offloading (new in R80.20+)

Re: R80.20 - new interesting commands

HeikoAnkenbrand — Tue, 16 Oct 2018 07:55:28 GMT

New ClusterXL clish commands:

> show cluster

> show cluster mmagic

More see here:

R80.20 - new ClusterXL commands

Regards,

Heiko

Re: R80.20 - new interesting commands

Sandro_Gerdel — Sun, 21 Oct 2018 07:27:16 GMT

Nice new commands.

Cheers,

Sandro

Re: R80.20 - new interesting commands

_Jelle — Wed, 24 Oct 2018 14:56:12 GMT

This looks a lot like #sim dropcfg which has the same functionality.

edit:

Off course its handy to have a link to more information of this useful feature

See Accelerated Drops which is supported since 75.40

Re: R80.20 - new interesting commands

HeikoAnkenbrand — Mon, 05 Nov 2018 18:03:42 GMT

Fetches and unloads Threat Prevention policy.

Threat Prevention policy applies to these Software Blades:

Anti-Bot
Anti-Virus
Anti-Spam
Threat Emulation
Threat Extraction
IPS

# fw amw unload -> To unload the current Threat Prevention policy.

# fw amw fetch localhost -> To fetch the Threat Prevention policy stored locally on the Security Gateway.

More see:

Command Line Interface R80.20 Reference Guide

Re: R80.20 - new interesting commands

_Val_ — Tue, 06 Nov 2018 09:41:36 GMT

it would help to put a link to CLI reference guide in the original post

Re: R80.20 - new interesting commands

Yoni-Indeni — Tue, 13 Nov 2018 15:27:02 GMT

Have you ever seen the queue fill up? Is this something worth tracking and adding a script to Indeni for?

Re: R80.20 - new interesting commands

HeikoAnkenbrand — Thu, 06 Dec 2018 21:43:03 GMT

"iotop" watches I/O usage information output by the Linux kernel and displays a table of current I/O usage by processes or threads on the system. Only available on gateway with R80.20 3.10 kernel (see Check Point R80.20 with Gaia 3.10 for Security Gateways).

# iotop -b -n 1

Re: R80.20 - new interesting commands

Patricia_OSulli — Sat, 08 Dec 2018 15:33:06 GMT

great job

Re: R80.20 - new interesting commands

Arild_Ollestad — Wed, 12 Dec 2018 12:21:58 GMT

Very good article, thanks

Re: R80.20 - new interesting commands

Achilles_Tagg — Fri, 28 Dec 2018 01:31:34 GMT

This is very informative. Thanks!

Re: R80.20 - new interesting commands

Luka_Walhalder — Wed, 06 Feb 2019 15:37:32 GMT

Great new commands.