Unable to export Checkpoint firewall rulebase

[nilanjan_lahiri]

Hello All,

I am trying to export the Checkpoint firewall rulebase, however, getting the following error :- 

[Expert@HAL-VPN-FW1:0]# $MDS_FWDIR/scripts/web_api_show_package.sh
Script stopped running due to severe error!
Result file location: show_package-2025-09-22_10-09-14.tar.gz

The generated file is just 4/5 lines and doesn't show the expected output. 

[Expert@HAL-VPN-FW1:0]# mgmt_cli show access-rulebase
Username: admin
Password:
Couldn't connect to server
If you need to use a proxy server, add the '--proxy' parameter
[Expert@HAL-VPN-FW1:0]#

Please could you help to resolve this issue. 

Thank You,

Nilanjan 

[Danny · Accepted solution]

The hostname indicates that you are trying to run this on the firewall gateway while those commands are meant to be run on the firewall management.

[the_rock]

That was the first thing I noticed what @Danny mentioned, just run fwm ver and see what it gives, if it does not work, then 100% you are on the gateway and NOT mgmt server.

Anddy

[the_rock · Accepted solution]

Here is the proof from my lab.

Andy

*********************************

[Expert@CP-FW-01:0]# fwm ver
This is not a Security Management Server station.
[Expert@CP-FW-01:0]#

[Expert@CP-MANAGEMENT:0]# fwm ver
This is Check Point Security Management Server R82 - Build 007
[Expert@CP-MANAGEMENT:0]#

[Expert@CP-MANAGEMENT:0]# $MDS_FWDIR/scripts/web_api_show_package.sh
Script finished running successfully!
Result file location: show_package-2025-09-23_13-15-50.tar.gz
[Expert@CP-MANAGEMENT:0]# ls -lh show_package-2025-09-23_13-15-50.tar.gz
-rw-rw---- 1 admin root 367K Sep 23 13:16 show_package-2025-09-23_13-15-50.tar.gz
[Expert@CP-MANAGEMENT:0]# pwd
/home/admin
[Expert@CP-MANAGEMENT:0]#

[nilanjan_lahiri]

Thank you for responding on this. I am trying to export the rule from the Management only. Please refer to the output below :- 

[Expert@HAL-VPN-FW1:0]# fwm ver
This is Check Point Security Management Server R80.40 - Build 039
[Expert@HAL-VPN-FW1:0]# $MDS_FWDIR/scripts/web_api_show_package.sh
Script stopped running due to severe error!
Result file location: show_package-2025-09-23_19-18-33.tar.gz

Please could you help...

[the_rock]

Of course we can help and we will help, thats what we do here!

Anywho, if I were you, since its management, just try either cprestart and see if that works, but if not, just do a quick reboot.

Andy

[nilanjan_lahiri]

Neither cprestart, nor reboot helped me to resolve the issue. Could it be due to cluster issue? Is there any way that could be checked. 

Thanks !

[the_rock]

its management ha?

[the_rock]

Here is example of what it would look like (again, just my lab, but you get an idea, this is when you extract the file it generates)

Andy

[nilanjan_lahiri]

Apologies for not being able to respond earlier. Could you please help how to validate the Management HA. I am getting the following output while running the below command :- 

HAL-VPN-FW1> cphaprob -a if

CCP mode: Manual (Unicast)
Required interfaces: 3
Required secured interfaces: 1

Interface Name: Status:

eth1 UP
eth2 UP
Sync (S) UP
Mgmt Non-Monitored

S - sync, LM - link monitor, HA/LS - bond type

Virtual cluster interfaces: 2

eth1 81.x.x.x
eth2 22.x.x.x

[the_rock]

Lets clarify some things, so its all clear 100%. Since you are trying to do this on mgmt, cphaprob -a if command is ONLY valid on the firewall, it would never work on management itself, unless it was full HA, which it does not sound like it would be in your case, but please correct me if Im mistaken.

Secondly, can you run fwm ver command from that same prompt? To me, that 100% looks like its fw itself, NOT mgmt server.

Andy

[nilanjan_lahiri]

I am getting the following output :- 

HAL-VPN-FW1> fwm ver
This is Check Point Security Management Server R80.40 - Build 039

[the_rock]

Guess I was mistaken, does appear you have 2 standalones in a cluster, aka Full HA config. What does cpstat mg command show?

From my lab:

[Expert@CP-MANAGEMENT:0]# cpstat mg

Product Name: Check Point Security Management Server
Major version: 6
Minor version: 0
Build number: 998000007
Is started: 1
Active status: active
ICA status: 0
Status: The Internal Certificate Authority (ICA) certificate is valid until Jan 19 03:14:07 2038 GMT

Connected clients
----------------------------------------------------
|Client type |Administrator|Host |Database lock|
----------------------------------------------------
|SmartConsole|admin |EVE-WIN11|false |
----------------------------------------------------

[Expert@CP-MANAGEMENT:0]#

[the_rock]

@nilanjan_lahiri If you allow remote session, let me know, I will message you offline, we can do zoom.

Let me know.

Best,

Andy

[nilanjan_lahiri]

Below is the output. I will surely try for a remote session, will update you accordingly. Thanks @the_rock 

[Expert@HAL-VPN-FW1:0]# cpstat mg

Product Name: Check Point Security Management Server
Major version: 6
Minor version: 0
Build number: 994000039
Is started: 1
Active status: active
Status: OK

Connected clients
----------------------------------------------
|Client type|Administrator|Host|Database lock|
----------------------------------------------
----------------------------------------------

[the_rock]

Looks right to me. So if you run below, still fails?

$MDS_FWDIR/scripts/web_api_show_package.sh

If so, just go to scripts dir and run chmod 777 * and try again.

Andy

[nilanjan_lahiri]

Yes, it still fails... Please see below :- 

[Expert@HAL-VPN-FW1:0]# $MDS_FWDIR/scripts/web_api_show_package.sh
Script stopped running due to severe error!
Result file location: show_package-2025-10-06_12-19-19.tar.gz
[Expert@HAL-VPN-FW1:0]#

[the_rock]

Just message me directly if you can do remote.

Best,

Andy