cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post

SSH Cipher, SSH Hmac Version

Anyone can provide me the step of SSH Server Cipher and Hmac Version to change.Thanks Win

What is the expected traffic in a packet capture for Checkpoint High Avalibility?

While working on a issue I noticed this on a wireshark packet capture on my Nexus 9000 switch is connected to a 15400 XL running Gaia 80.33 (whatever the current version is). There are two 15400 XL in one DC1 and 2 in DC2. The 4 are all clustered together for the VSS. The 192.168.xxx.xx is checkpoint's "internal switch" address. My question is should I be seeing these messages sent to the switchport that is connected to the firewall? The port that is connected to the firewall from the Nexus is for multicast traffic. I did a packet capture in our QA environment which is a mirror of our production with the exception of there are only 2 15400 XL and I don't see these messages below. Is this a mis- configuration of the Firewall High Availability being sent to the Nexus connecting port? 2019-07-10 15:34:26.154998 0.0.0.0 -> 192.168.xxx.xx CPHA CPHAv3223: FWHA_MY_STATE2019-07-10 15:34:26.155007 0.0.0.0 -> 0.0.0.0 CPHA CPHAv3223: FWHA_IFCONF_REQ2019-07-10 15:34:26.155010 0.0.0.0 -> 0.0.0.0 CPHA CPHAv3223: FWHA_IFCONF_REQ2019-07-10 15:34:26.155013 0.0.0.0 -> 0.0.0.0 CPHA CPHAv3223: FWHA_IFCONF_REQ
Pedro_Espindola
Pedro_Espindola inside SMB Appliances and SMP yesterday
views 85 4 1

Version R77.20.87 Build 990172938 not documented

Hello everyone, Does anybody know anything about version R77.20.87 Build 990172938 for SMB appliances? It is not documented but it has a download page and is available in the Firmwares page of the SMP.

R80.20 MTU and SecureXL Problem

Hello,we have a Ethernet-Link (no VPN from Checkpoint) to a network where the MTU is 1422. If we set the mtu on the interface and disable SecureXL the Clients (with default MTU of 1500) get the ICMP Fragmentation Packet and start to send packets with smaller MTU.When we reactivate SecureXL the Clients starts to send 1500 byte packets again and do not get an ICMP Fragmentation paket from the Firewall.We are using an Checkpoint 5600 Cluster with R80.20 with latest HFA.Did anybody had the same problem? Jan

'Invalid segment retransmission. Packet dropped.'

Hi All, we have a client not able to connect to an FTP server. The connection goes through the internal firewall and then gets dropped by our external CP (80.10). The sync packet is okay, but then it is actually dropped by the same rule that should be allowing it with the 'Invalid segment retransmission. Packet dropped.' comment. Please see the below screen.We initially thought it was down to the application (FileZilla), but it seems it's the same, for example, from win command line. Thank you for any comments.

CPAP-23800 and CPAC-2-40F-B

Hi,are there guidelines how to install two CPAC-2-40F-B modules into a CPAP-23800 appliance in order to achieve optimal performance (CPU/PCIe topology)? I had a look into the various guides, sk116742 and sk107516, but wasn't able to find any information about which cpu connects to which expansion slot. ByeMichael

Not able to find the serial no.

Hi Every One.I have a UTM-1 570 and i want to get the Serial no of the device.But i am not able to do that.Please suggest the CLI command to get the serial no of the unit.thanks in advance.

Dropped Radius Packets with 80.20 Gateway

Hello,just upgraded a CPAP-13500 cluster to R80.20. Everything worked fine except that RADIUS packets (1812/udp) larger than about 1000 bytes getting dropped without log, not even with a drop debug message. Seems like they get dropped at the interface level, somewhere between interface and In-Chain.If I tcpdump on incoming and outgoing interface, I can see packets incoming to the gateway but none is leaving on the outgoing interface. If I'm using fw monitor, I even can't see any packets.Reverting to R77.30 solved the problem.Does anybody have a clue? Is this a known issue? ByeMichael

Proxy ARP after upgrade to R80.30

This week we had some clusters upgraded from R80.10 to R80.30, the customer wants the new and improved HTTPS functionality. When we were done, on 2 VRRP clusters we had some automatic NAT and a special Hide NAT (for WiFi guests) After upgrading you install the policy twice, first the acces and then again for the Threat Prevention policy. After some time we were told the Guest WiFi did not work, investigation pointed in the end to the proxy ARP that was not active, so we added the Proxy ARP command for the Hide address, pushed the access policy (the third time). After looking with fw ctl arp we then saw 2 Proxy ARP addresses, the one we added and the other was a automatic NAT. After removing the manual Proxy ARP again, the fw ctl arp kept showing both ARP entries. When we upgraded the other cluster we checked again after 1, 2 and 3 pushes of the access policy and only after the third push the Proxy ARP addresses showed up. It has been reported and R&D will be informed.

Netflow for R80.10

Anyone ever send Netflow data to Stealthwatch, I'm can't find any data sheet that list the collectors that are compatible with Checkpoint Firewall.

R77.10 maintenance mode

Hi,after rebooting the primary in XL cluster , I got the below message:*** please reboot in the maintenance mode to repair filesystem when I rebooted the firewall , can't see "press any key to see boot menu " . I read it could be defaulted to 0 second.is there is thing I can do ? any advice is highly appreciated .

750 Randomly Disconnect from Cloud Services

750 Randomly Disconnect from Cloud Services SMP, this happens a few times everyday and client looses internet connection and we do not have access to logs on the Device as well. Please help if any has a solution to this.
Krishna
Krishna inside Access Control Products Monday
views 335 3

Post-Encrypt traffic is not visible in Fw monitor. Other end FW is not receiving traffic sent by me

Below are the logs collected from the primary gateway of my firewall. In "O" the source IP is getting NATed to the NAT IP and then pre-encrypt is shown and not receiving the POST-encrpt packet.The other end firewall is not observing any traffic. [vs_0][fw_2] eth1:i[60]: 10.140.96.6 -> 10.232.144.14 (TCP) len=60 id=42611TCP: 40768 -> 515 .S.... seq=24587d9c ack=00000000[vs_0][fw_2] eth1:I[60]: 10.140.96.6 -> 10.232.144.14 (TCP) len=60 id=42611TCP: 40768 -> 515 .S.... seq=24587d9c ack=00000000[vs_0][fw_2] eth0:o[60]: 10.140.96.6 -> 10.232.144.14 (TCP) len=60 id=42611TCP: 40768 -> 515 .S.... seq=24587d9c ack=00000000[vs_0][fw_2] eth0:O[60]: 10.40.112.6 -> 10.232.144.14 (TCP) len=60 id=42611TCP: 40768 -> 515 .S.... seq=24587d9c ack=00000000[vs_0][fw_2] eth0:e[60]: 10.40.112.6 -> 10.232.144.14 (TCP) len=60 id=42611TCP: 40768 -> 515 .S.... seq=24587d9c ack=00000000

High dispatcher cpu

I've had ongoing issues since moving to R80.x with high dispatcher core usage. We have 21800 gateways . We've had multiple TAC cases, they had us add a 3rd dispatcher core and set the affinity for the cores manually, but i still consistently see the 10Gb interfaces spike the dispatcher CPU's in what should be low utilization situations for this model gw. We are on R80.20 jumbo 87, gateways were freshly reinstalled direct on R80.20 after continuous crashes across both cluster members in the last few days (will not be upgrading cluster in place again)..priority queues are off per TAC.any ideas would be appreciated... put some info below for context CPU 0: eth1-02 eth1-04CPU 1: eth3-02 eth1-01 eth1-03CPU 2: eth3-01 eth3-03 eth3-04 MgmtCPU 3: fw_16in.acapd fgd50 lpd cp_file_convertd rtmd usrchkd rad in.geod mpdaemon in.msd wsdnsd pdpd pepd in.asessiond vpnd fwd cpd cpridCPU 4: fw_15in.acapd fgd50 lpd cp_file_convertd rtmd usrchkd rad in.geod mpdaemon in.msd wsdnsd pdpd pepd in.asessiond vpnd fwd cpd cpridCPU 5: fw_14in.acapd fgd50 lpd cp_file_convertd rtmd usrchkd rad in.geod mpdaemon in.msd wsdnsd pdpd pepd in.asessiond vpnd fwd cpd cpridCPU 6: fw_13in.acapd fgd50 lpd cp_file_convertd rtmd usrchkd rad in.geod mpdaemon in.msd wsdnsd pdpd pepd in.asessiond vpnd fwd cpd cpridCPU 7: fw_12in.acapd fgd50 lpd cp_file_convertd rtmd usrchkd rad in.geod mpdaemon in.msd wsdnsd pdpd pepd in.asessiond vpnd fwd cpd cpridCPU 8: fw_11in.acapd fgd50 lpd cp_file_convertd rtmd usrchkd rad in.geod mpdaemon in.msd wsdnsd pdpd pepd in.asessiond vpnd fwd cpd cpridCPU 9: fw_10in.acapd fgd50 lpd cp_file_convertd rtmd usrchkd rad in.geod mpdaemon in.msd wsdnsd pdpd pepd in.asessiond vpnd fwd cpd cpridCPU 10: fw_9in.acapd fgd50 lpd cp_file_convertd rtmd usrchkd rad in.geod mpdaemon in.msd wsdnsd pdpd pepd in.asessiond vpnd fwd cpd cpridCPU 11: fw_8in.acapd fgd50 lpd cp_file_convertd rtmd usrchkd rad in.geod mpdaemon in.msd wsdnsd pdpd pepd in.asessiond vpnd fwd cpd cpridCPU 12: fw_7in.acapd fgd50 lpd cp_file_convertd rtmd usrchkd rad in.geod mpdaemon in.msd wsdnsd pdpd pepd in.asessiond vpnd fwd cpd cpridCPU 13: fw_6in.acapd fgd50 lpd cp_file_convertd rtmd usrchkd rad in.geod mpdaemon in.msd wsdnsd pdpd pepd in.asessiond vpnd fwd cpd cpridCPU 14: fw_5in.acapd fgd50 lpd cp_file_convertd rtmd usrchkd rad in.geod mpdaemon in.msd wsdnsd pdpd pepd in.asessiond vpnd fwd cpd cpridCPU 15: fw_4in.acapd fgd50 lpd cp_file_convertd rtmd usrchkd rad in.geod mpdaemon in.msd wsdnsd pdpd pepd in.asessiond vpnd fwd cpd cpridCPU 16: fw_3in.acapd fgd50 lpd cp_file_convertd rtmd usrchkd rad in.geod mpdaemon in.msd wsdnsd pdpd pepd in.asessiond vpnd fwd cpd cpridCPU 17: fw_2in.acapd fgd50 lpd cp_file_convertd rtmd usrchkd rad in.geod mpdaemon in.msd wsdnsd pdpd pepd in.asessiond vpnd fwd cpd cpridCPU 18: fw_1in.acapd fgd50 lpd cp_file_convertd rtmd usrchkd rad in.geod mpdaemon in.msd wsdnsd pdpd pepd in.asessiond vpnd fwd cpd cpridCPU 19: fw_0in.acapd fgd50 lpd cp_file_convertd rtmd usrchkd rad in.geod mpdaemon in.msd wsdnsd pdpd pepd in.asessiond vpnd fwd cpd cpridAll: scanengine_b sim affinity -lMgmt : 2eth1-01 : 1eth1-02 : 0eth1-03 : 1eth1-04 : 0eth3-01 : 2eth3-02 : 1eth3-03 : 2eth3-04 : 2 fwaccel stats -sAccelerated conns/Total conns : 5632/11726 (48%)Accelerated pkts/Total pkts : 87217254/91349341 (95%)F2Fed pkts/Total pkts : 4132087/91349341 (4%)F2V pkts/Total pkts : 349157/91349341 (0%)CPASXL pkts/Total pkts : 78606120/91349341 (86%)PSLXL pkts/Total pkts : 5653296/91349341 (6%)CPAS inline pkts/Total pkts : 0/91349341 (0%)PSL inline pkts/Total pkts : 0/91349341 (0%)QOS inbound pkts/Total pkts : 89478397/91349341 (97%)QOS outbound pkts/Total pkts : 90834289/91349341 (99%)Corrected pkts/Total pkts : 0/91349341 (0%) fw ctl multik statID | Active | CPU | Connections | Peak----------------------------------------------0 | Yes | 19 | 927 | 11041 | Yes | 18 | 805 | 9432 | Yes | 17 | 781 | 16063 | Yes | 16 | 814 | 12174 | Yes | 15 | 944 | 17225 | Yes | 14 | 895 | 11526 | Yes | 13 | 1102 | 16807 | Yes | 12 | 781 | 16748 | Yes | 11 | 1063 | 10639 | Yes | 10 | 741 | 102410 | Yes | 9 | 1002 | 105311 | Yes | 8 | 810 | 101612 | Yes | 7 | 799 | 96413 | Yes | 6 | 831 | 183714 | Yes | 5 | 833 | 101715 | Yes | 4 | 841 | 108716 | Yes | 3 | 862 | 1329 free -mtotal used free shared buffers cachedMem: 64282 12574 51708 0 105 3124-/+ buffers/cache: 9344 54938Swap: 32765 0 32765
Shlomi_Feldman
inside SCADA Solutions Saturday
views 65 1
Employee+

A funny approach what is PLC

Many times I think that the ICS/SCADA cyber security subject, is too serious based on doomsday imagination. this is why I like such comic publication, as it explain us the subject but still don't save us from all the fear aspects. small spoiler, I never thought that the first ICS cyber attack took place in the star-wars movies