topic Re: possible to extract last installed policy from centrally managed SMB GAIA in Spark Firewall (SMB)

possible to extract last installed policy from centrally managed SMB GAIA

Garrett_DirSec — Mon, 02 Oct 2023 19:55:22 GMT

Hello -- without boring everyone with the details, we have the following situation:

Customer has numerous 1500-series SMB GAIA device that are used on annual basis (during election cycle). These device spent months sitting in cold storage and brought out couple months before use.

The issue: due to various issues, the central SmartCenter mgmt service used for these devices was "lost". No backups.

Customer is asking if we can extract the installed policy on SMB GAIA device and use to rebuild SmartCenter policy.

I realize that installed policy is compiled and human readable references are removed (and likely not available .. but unsure).

However, I didn't want to say explicitly "NO" without getting some input.

Any insight would be appreciated. -GA

Re: possible to extract last installed policy from centrally managed SMB GAIA

Garrett_DirSec — Mon, 02 Oct 2023 19:59:17 GMT

BTW -- I found this great article on support.

Policy installation flow

https://support.checkpoint.com/results/sk/sk101226

Re: possible to extract last installed policy from centrally managed SMB GAIA

G_W_Albrecht — Tue, 03 Oct 2023 08:15:16 GMT

Try a show configuration to see details of the SMBs configuration. For GAiA find a discussion here:

https://community.checkpoint.com/t5/Security-Gateways/Show-Ruleset-and-Objects-on-the-Gateway-Emergency-Recovery/m-p/155533#M30470

The used db_tool is not present on SMBs running R81.10.0x, but what should be true is: TAC / PS have developed a CP-internal method to recover the security policy from a gateway. Ask them for help in such cases.

Re: possible to extract last installed policy from centrally managed SMB GAIA

PhoneBoy — Tue, 03 Oct 2023 14:47:29 GMT

I assume you might be able to find something in $FWDIR/state/local/FW1 similar to a regular gateway.