Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Explorer

Export Firewall configuration

Jump to solution

Hi Mates,

I am using 2 x CheckPoint 5600 Firewall in my workplace.
We are requested by our Internal Audit that we need to export and review the Firewall configuration periodically.
I am the only person here who hold the Firewall Administrator password, and I am not allow to share out the admin pwd.

Can anyone guide me on how to create a READ ONLY account that can export the FireWall Configuration file?

thank you very much.
---david

0 Kudos
Reply
1 Solution

Accepted Solutions
Admin
Admin

Incorrect. You already have built-in monitor user in Gaia. Alternatively, create a new and assign monitorOnly role to it.

This user (you will have to reset its password) is allowed to SSH, CLISH only. It can run "show..." commands. In this context, "show configuration" is what you are looking for.

It will not "export" config out, but will allow auditors to see output of config as part of the ssh session. They can log the session and use the data. 

You do not want to give read-only users access to expert. If you are looking for a capability to send a file out, that is exactly the issue. Expert mode trumps all CLISH restrictions.

View solution in original post

0 Kudos
Reply
8 Replies
Admin
Admin

What kind of export? MGMT database? OS settings? Please elaborate

0 Kudos
Reply
Explorer

Only the OS settings.  thank you.

0 Kudos
Reply
Admin
Admin

You need to set up a new OS account and assign it to monitorOnly role

Read the Gaia admin guide for more details.https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_Gaia_AdminGuide/Content/Topi...

0 Kudos
Reply
Explorer

Hi _Val_, The two READ ONLY accounts that i mentioned were exactly in the MonitorRole.  But they seem do not have the privilege to export the configuration nor ssh-in.  thanks. --david 

0 Kudos
Reply
Admin
Admin

Incorrect. You already have built-in monitor user in Gaia. Alternatively, create a new and assign monitorOnly role to it.

This user (you will have to reset its password) is allowed to SSH, CLISH only. It can run "show..." commands. In this context, "show configuration" is what you are looking for.

It will not "export" config out, but will allow auditors to see output of config as part of the ssh session. They can log the session and use the data. 

You do not want to give read-only users access to expert. If you are looking for a capability to send a file out, that is exactly the issue. Expert mode trumps all CLISH restrictions.

View solution in original post

0 Kudos
Reply
Explorer

thank you!

0 Kudos
Reply
Admin
Admin

you are welcome

0 Kudos
Reply
Explorer

according to some experts they mention something adding a RULE to allow these READ ONLY accounts to access SSH and the WEB interface that can serve the same purpose.  Can you please guide me through how to set this rule(s)?  Many Many thanks. --david

0 Kudos
Reply