topic Re: How do I do an "or" chooise in $FWDIR/conf/local.scv in SASE and Remote Access

How do I do an "or" chooise in $FWDIR/conf/local.scv

Anders_Gustafss — Wed, 24 Mar 2021 15:12:37 GMT

Hi,

We have been using a SCV register check on our Windows 10 computers Mobile VPN clients for some years but we placed the registry check value in a "bad place" so every time we upgrade Window 10 the registry is updated and our registry value is deleted.
Now we want to change the registry value to a "safer place" in registry and want to complement the $FWDIR/conf/local.scvfile with an "or" chooise so we can push out new Windows 10 images with the updated place i registry.

So my question is, how do we do an "or" chooise between two registry values in $FWDIR/conf/local.scv?

I can´t find any examples how to do this, but I hope it isn´t impossible and that someone know how to do it.

Regards
Anders

Re: How do I do an "or" chooise in $FWDIR/conf/local.scv

PhoneBoy — Fri, 26 Mar 2021 16:45:21 GMT

Here's a slightly modified example from: https://community.checkpoint.com/t5/Remote-Access-VPN/Real-World-local-scv-Example/m-p/81381/highlight/true#M3084

		: (RegMonitor
			:type (plugin)
			:parameters (
				:begin_or (1)
                                        :string ("SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Domain=DomainA")
					:string ("SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Domain=DomainB")
				:end (or1)
				:begin_admin (admin)
					:send_log (alert)
					:mismatchmessage ("Must be member of DomainA or DomainB")
				:end (admin)
			)
		)

Re: How do I do an "or" chooise in $FWDIR/conf/local.scv

Anders_Gustafss — Thu, 08 Apr 2021 08:35:03 GMT

Many thank´s PhoneBoy, you made my day 🙂

Re: How do I do an "or" chooise in $FWDIR/conf/local.scv

Air — Mon, 08 Jul 2024 13:13:06 GMT

Hello,

Can you help?

I want check two different option in RegMonitor and write different message for every option.

Example: 1. check domain and 2. own record in registry.

And if 1 pass and 2 don't pass that send message about 2 option. If two option mismatch that two different message:

: (RegMonitor :type (plugin) :string ("SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Domain=def.domain") :begin_admin (admin) :send_log (alert) :mismatchmessage ("Your computer doesn't meet the domain membership requirements. Domain must be def.domain") :end (admin) :string ("SOFTWARE\WOW6432Node\Security Status="Red") :begin_admin (admin) :send_log (alert) :mismatchmessage ("Your computer Status Red. Please update status to Green.") :end (admin) )

Re: How do I do an "or" chooise in $FWDIR/conf/local.scv

PhoneBoy — Mon, 08 Jul 2024 19:35:55 GMT

For that, I believe you need two RegMonitor stanzas

: (RegMonitor :type (plugin) :parameters ( :string ("SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Domain=DomainA") :begin_admin (admin) :send_log (alert) :mismatchmessage ("Must be member of DomainA") :end (admin) ) ) : (RegMonitor :type (plugin) :parameters ( :string ("SOFTWARE\WOW6432Node\Security Status="Red") :begin_admin (admin) :send_log (alert) :mismatchmessage ("Change computer status to Green") :end (admin) ) )

Re: How do I do an "or" chooise in $FWDIR/conf/local.scv

Air — Mon, 08 Jul 2024 20:03:27 GMT

Unfortunately, it doesn't work

Re: How do I do an "or" chooise in $FWDIR/conf/local.scv

PhoneBoy — Mon, 08 Jul 2024 20:25:52 GMT

What is the precise behavior that occurs?
What do you see when you try and debug scv?
Follow the steps here: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_PerformanceTuning_AdminGuide/Topics-PTG/Kernel-Debug/Kernel-Debug-Procedure.htm?tocpath=Kernel%20Debug%20on%20Security%20Gateway%20%7C_____3
For the debug flags (Step 8), I believe you'll need fw ctl debug -m fw + scv

TAC may have other suggestions here.