Are you a member of CheckMates?
×
Sign in with your Check Point UserCenter/PartnerMap account to access more great content and get a chance to win some Apple AirPods! If you don't have an account, create one now for free!
1 Solution
Accepted Solutions
Another quick 'n' dirty solution based on Prometheus:
1. On the gateway itself, I created a Prometheus metrics template (index.template).
# HELP cp_vpn_count Number of VPN connected users.
# TYPE cp_vpn_count gauge
cp_vpn_count {{cp_vpn_count}}
2. Still on the gateway, a very simple script (prometheus_metrics.sh) to replace the template variables and write the output to a text file (index.txt). It probably should have been Python/Jinja2/HTML, it was easier to do with bash/sed/txt.
#!/bin/bash
cp_vpn_count=`fw tab -t userc_users -s | grep userc | tr -s ' ' | cut -d ' ' -f 4`
sed "s/{{cp_vpn_count}}/$cp_vpn_count/g" /tmp/cptest/index.template > /tmp/cptest/index.txt
3. Create a cronjob on the gateway to run the script every minute or so...
* * * * * /tmp/cptest/prometheus_metrics.sh
4. ...and run a simple web server to publish the metrics. Please don't tell our security officer that I'm saying this!
python3 -m http.server
5. Finally, configure Prometheus to scrape the published metrics from CP.
- job_name: 'checkpoint'
scrape_interval: 60s
metrics_path: '/index.txt'
static_configs:
- targets:
- 10.25.103.52:8000
Result:
Or in Grafana:
Apart from the security nightmare of running a web server on a firewall (which may be mitigated if we're talking about sane people), I think I prefer this approach because it's easily scalable: just adjust the template and script to add more command outputs.
Anyway, whichever approach one may choose, great work Mythryll and thanks for sharing it.
Welcome to this community.
So you did a lot of work getting all this done with so many different tools just to get a single graph on RAS-VPN user count. Wow. Check Point SmartEvent provides you with this graph directly. As you work in a critical infrastructure I'm sure you have a license for it. Here are some examples for RAS-VPN reports: Basic, Enhanced, Application Monitoring, Custom User Stats
Also SmartView Monitor can easily provide you with that graph on VPN history.
Hi,
I had the same requirement but I took a different approach, this was essentially just to provide a page to illustrate how the remote access service was performing during the early days of lockdown.
I created a jobuser on my gateway to run cron jobs, see sk77300
That allowed me to run a script every 5 minutes
#!/bin/bash -f
source /opt/CPshrd-R80.20/tmp/.CPprofile.sh
fw tab -t userc_users -s | grep userc | cut -c63-67 | xargs -I {} curl_cli http://REDACTED:1880/checkpoint?now={}
The first 2 lines are boiler plate supplied by Check Point, the last line takes the user count and pipes it to curl. The REDACTED internal host is a node-red server that just runs a simple output to a dashboard graph node.
Bruce
Another quick 'n' dirty solution based on Prometheus:
1. On the gateway itself, I created a Prometheus metrics template (index.template).
# HELP cp_vpn_count Number of VPN connected users.
# TYPE cp_vpn_count gauge
cp_vpn_count {{cp_vpn_count}}
2. Still on the gateway, a very simple script (prometheus_metrics.sh) to replace the template variables and write the output to a text file (index.txt). It probably should have been Python/Jinja2/HTML, it was easier to do with bash/sed/txt.
#!/bin/bash
cp_vpn_count=`fw tab -t userc_users -s | grep userc | tr -s ' ' | cut -d ' ' -f 4`
sed "s/{{cp_vpn_count}}/$cp_vpn_count/g" /tmp/cptest/index.template > /tmp/cptest/index.txt
3. Create a cronjob on the gateway to run the script every minute or so...
* * * * * /tmp/cptest/prometheus_metrics.sh
4. ...and run a simple web server to publish the metrics. Please don't tell our security officer that I'm saying this!
python3 -m http.server
5. Finally, configure Prometheus to scrape the published metrics from CP.
- job_name: 'checkpoint'
scrape_interval: 60s
metrics_path: '/index.txt'
static_configs:
- targets:
- 10.25.103.52:8000
Result:
Or in Grafana:
Apart from the security nightmare of running a web server on a firewall (which may be mitigated if we're talking about sane people), I think I prefer this approach because it's easily scalable: just adjust the template and script to add more command outputs.
Anyway, whichever approach one may choose, great work Mythryll and thanks for sharing it.
