"Command to check which policy set is installed on a Gateway or cluster."

[SecdetKrypton]

I want to know the command to check which policy set is installed on a gateway and how to revert the incorrect policy installation on the wrong gateway.

[the_rock]

https://sc1.checkpoint.com/documents/latest/APIs/?#cli/install-policy~v2%20

If you have expert mode, just run fw stat to see which policy is currently installed, or if threat prevention is also active, then fw stat -b AMW. To revert, if you have access to smart console, you can install it from there, but if not, then you need to use mgmt_cli

Andy

[AkosBakos · Accepted solution]

Hi,

Totally agree with @the_rock, but if you not a CLI expert, just learn this command: cpview

[Timothy_Hall]

Normally you would reinstall the correct policy to the gateway from the SmartConsole as the_rock said.  However if you can't do that for some reason, starting in R81.20 Jumbo 54+ and R82 the gateway itself will cache the last two policies installed prior to the current one.  These can be reinstalled right from the gateway itself using policy_rev_tool: sk181437: Access Control Policy Revert Tool (policy_rev_tool)

This is one of the tips in my upcoming CPX Vegas presentation.

[Lesley]

Only thing i would like to add, if for some reason you cannot re-install the correct policy. You might need to run:

fw unloadlocal

Description

Uninstalls all policies from the Security Gateway or Cluster Member.

Warning: The "fw unloadlocal" command prevents all traffic from passing through the Security Gateway (Cluster Member), because it disables the IP Forwarding in the Linux kernel on the Security Gateway (Cluster Member). The "fw unloadlocal" command removes all policies from the Security Gateway (Cluster Member). This means that the Security Gateway (Cluster Member) accepts all incoming connections destined to all active interfaces without any filtering or protection enabled.