CPme - a simple tool to analyze your check point environment - for R80.20 and above

[0x7c2]

Hi all,

in the last few months, I created a tool which helps you to analyze your running Check Point environment. The tool provides several checks for your Security Gateway and also for the Security Management.

I know, that there are already some really good tools and scripts - but with another point of view.

So I proudly announce CPme to you, released as an open source tool:

https://github.com/0x7c2/cpme

Some screenshots:

Maybe it is useful for you and your environment, maybe not - your choice 😉

Regards,
Simon

[Danny]

Wow Simon, what an outstanding first post on this community! 👍

Looks like you've spent a huge amount of effort and passion developing CPme. I'm overwhelmed by the outstanding level of Check Point expertise involved in this Python script that it really surprises me how many issues I had navigating through the menu by entering numbers, not being able to go back when I don't want to execute something (such as fw monitor) and that I can't leave the script by pressing ESC whenever I want to. I guess I'm just too used to navigate with arrow keys within cpview and ccc.

[0x7c2]

Hi Danny,

thank you for the feedback.
Seems that next step for CPme is: Optimizing the „GUI“ 😉 That shouldn't be an impossible task, but as far, it was not in focus of me. 

[G_W_Albrecht]

Nice work - but i have found that input values are not checked, so invalid input will crash the script e.g.here:

+-v0.23---------------------------------------------------------------by-0x7c2-+
| Troubleshooting Options |
+------------------------------------------------------------------------------+
| 1. Run fw monitor with filter |
| 2. Run tcpdump with filter |
| 3. Run tcpdump, capture fragmented packets |
| 4. Run zdebug with options |
| 5. Print connection table - raw |
| 6. Print connection table - formatted |
| 7. Clear connection table (ALL!) |
| 8. Clear specific connections from table |
| 9. STOP CheckPoint Services |
| 10. STOP CheckPoint Services and keep policy |
| 11. UNLOAD Security/TP Policy |
| 12. FETCH Security/TP Policy |
| 13. Disable Antispoofing |
| 14. Enable Antispoofing |
| 15. ClusterXL Status |
| 16. SecureXL DoS Mitigation Status |
| 17. Display VPN Tunnel Status |
| 18. TOP 15 heavy F2F Connections (specific worker) |
| 19. TOP 15 heavy F2F Connections (all worker!) |
| 20. Measure kernel delay (EXPERIMENTAL!) |
| 21. Disable IPS on the fly |
| 22. Enable IPS on the fly |
| 23. Print heavy conns detected by CoreXL |
| 24. Back to Main Menu |
| 0. Exit from Script |
+------------------------------------------------------------------------------+
Enter your choice [0-24]: 8

Please enter common ip addresses. If you wish to disable filter, just
leave those fields empty.

Enter source ip : ^[
Enter destination ip: ^^q

Traceback (most recent call last):
File "/home/admin/cpme-py/cpme.py", line 122, in <module>
menu_display(menu_cur)
File "/home/admin/cpme-py/cpme.py", line 108, in menu_display
eval(exec_menu)
File "<string>", line 1, in <module>
File "/home/admin/cpme-py/troubleshooting.py", line 434, in clear_table_input
iphex_src=ip2hex(ip_src)
File "/home/admin/cpme-py/troubleshooting.py", line 229, in ip2hex
b = hex(int(a[0]))[2:].zfill(2) + hex(int(a[1]))[2:].zfill(2) + hex(int(a[2]))[2:].zfill(2) + hex(int(a[3]))[2:].zfill(2)
ValueError: invalid literal for int() with base 10: '\x1b'

Only cosmetic: Formatting of the last line in Health Analysis > Run All Checks is incorrect.

And a UI hint: Always having zero to Exit the script is nice, but Back to Main Menue number should not change from submenue to submenu, too 😎.

[PhoneBoy]

@_Val_ looks like a candidate for Toolbox.

[0x7c2]

Just uploaded a preview of CPme, version 2.
Main improvements:
---> user interface

@Danny : Maybe it's more intuitive for you 😉

Preview is available in seperate repository:
https://github.com/0x7c2/cpme2

The preview is actual missing some checks for management server, and all troubleshooting shortcuts.
They will be added soon.

[Danny]

Looks really good.. navigation is so much easier now. I failed to use the integrated search function and couldn't quit the script via ctrl-c. As you mimic the look&feel of cpview I initially expected it to behave similar. It took me some time to realize that some views don't have contents when shown and load contents afterwards. Overall you created an amazing tool that fully surpizes me by level of knowledge, execution and vision/passion. I'm glad to see people like you around here in this community.