possible to extract last installed policy from centrally managed SMB GAIA

[Garrett_DirSec]

Hello --  without boring everyone with the details, we have the following situation:

Customer has numerous 1500-series SMB GAIA device that are used on annual basis (during election cycle).    These device spent months sitting in cold storage and brought out couple months before use.

The issue:   due to various issues, the central SmartCenter mgmt service used for these devices was "lost".   No backups.

Customer is asking if we can extract the installed policy on SMB GAIA device and use to rebuild SmartCenter policy. 

I realize that installed policy is compiled and human readable references are removed (and likely not available .. but unsure).

However, I didn't want to say explicitly "NO" without getting some input.

Any insight would be appreciated.   -GA

[Garrett_DirSec]

BTW -- I found this great article on support. 

Policy installation flow

https://support.checkpoint.com/results/sk/sk101226

[G_W_Albrecht]

Try a show configuration to see details of the SMBs configuration. For GAiA find a discussion here:

https://community.checkpoint.com/t5/Security-Gateways/Show-Ruleset-and-Objects-on-the-Gateway-Emerge...

The used db_tool is not present on SMBs running R81.10.0x, but what should be true is: TAC / PS have developed a CP-internal method to recover the security policy from a gateway. Ask them for help in such cases.

[PhoneBoy]

I assume you might be able to find something in $FWDIR/state/local/FW1 similar to a regular gateway.