At a gateway, how do I determine what domain the gateway belongs to?

[George_Ellis]

Hi folks,

MDM Environment.  How can I determine at the gateway where a policy was installed from?  Even better, how can I determine the domain the gateway and policy belong to?

I tried finding a CLI command, MIB member, and even if I could find the name in logs or certificates.  Has anyone figured this out?

TIA
George Ellis @ IHG

[Chris_Atkinson]

You will get some clues from the following cmds:

netstat -an | grep 18192 

cpstat fw

[George_Ellis]

Netstat works to a degree as it list both MDMs.  Not the preferred method as I will have to create a if/then to assign the domain name to a variable based on the last octet.

There are multiple ways to get the policy name either via snmpwalk or this method (which is what I use)
fw stat | awk '/localhost/ {print $2,$3}'

Bonus content:  - Get the IP of the Log server.
cpstat fw -f log_connection |grep 'Log-Server Connected' | awk '{print $1}' | sed 's/|//g'
<Reply is IP>

cpstat fw -f log_connection |grep 'Log-Server Disconnected' | awk '{print $1}' | sed 's/|//g'

<Reply is IP>

[the_rock]

See if this helps.

Andy

https://community.checkpoint.com/t5/General-Topics/Policy-location-on-a-gateway-R80/td-p/46865

[the_rock]

Maybe check below too.

Andy

cat $FWDIR/state/local/FW1/local.set | grep -i policy

[the_rock]

Im pasting what you said in the other post from few years ago, will also try this in my R81.20 and R82 labs.

Andy

************************

Thanks guys for the directory suggestions (and the other replies)

I found the cheat code.  

cat $FWDIR/state/local/FW1/local.sic_name |grep 'o='|awk -F ,o= '{print $2}'|awk -F . '{print $NR}'

Background
cat local.sic_name
sic_name=cn=<fwname>,o=<domainname>..<CAthingy>

[George_Ellis · Accepted solution]

emmap's solution is even better.

cat $FWDIR/conf/masters

I got lazy and asked grok to do it faster than I could type and verify...

cat $FWDIR/conf/masters | awk '/\[Policy\]/ {flag=1; next} /\[/{flag=0} flag' | tr '\n' ' ' | xargs
cat $FWDIR/conf/masters | awk '/\[Log\]/ {flag=1; next} /\[/{flag=0} flag' | head -n 1
cat $FWDIR/conf/masters | awk '/\[Backup\]/ {flag=1; next} /\[/{flag=0} flag' | head -n 1

[the_rock]

Your command is great too, just tested in my lab.

Andy

[Expert@CP-FW-01:0]# cat $FWDIR/state/local/FW1/local.sic_name |grep 'o='|awk -F ,o= '{print $2}'|awk -F . '{print $NR}'
cp-management

[Expert@CP-FW-01:0]#

[emmap · Accepted solution]

If you want to see the primary DMS name (and secondary if you have put it in the gateway under 'Fetch Policy') and the log servers, you can cat the masters file.

[Expert@EXLGW-s01-01:0]# cat /var/opt/CPsuite-R82/fw1/conf/masters
[Policy]
MgmtName
[Log]
MgmtName
[Alert]
MgmtName

[George_Ellis]

That is even better.  It helps with verifying other things like "is there a secondary log server" and "is the HA MDM defined".

[Policy]
MgmtName
MgmtNameHA
[Log]
MgmtMLMPrimary
[Alert]
MgmtMLMPrimary
[Backup]
MgmtMLMSecondary

[George_Ellis]

BONUS TIME.

We are worldwide with 13 CMAs.  There is some mismatch of which firewalls are in which domain.  So I am in the CLI and need to go to the SmartConsole CMA.  If I don't remember where it resides, go to the MDM SC, click on GATEWAYS and SERVERS, look it up.

Oh, this is easy
"cat $FWDIR/conf/masters"

Ah, so open that CMA.