Export Firewall configuration

[davidso]

Hi Mates,

I am using 2 x CheckPoint 5600 Firewall in my workplace.
We are requested by our Internal Audit that we need to export and review the Firewall configuration periodically.
I am the only person here who hold the Firewall Administrator password, and I am not allow to share out the admin pwd.

Can anyone guide me on how to create a READ ONLY account that can export the FireWall Configuration file?

thank you very much.
---david

[_Val_]

What kind of export? MGMT database? OS settings? Please elaborate

[davidso]

Only the OS settings.  thank you.

[_Val_]

You need to set up a new OS account and assign it to monitorOnly role

Read the Gaia admin guide for more details.https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_Gaia_AdminGuide/Content/Topi...

[davidso]

Hi _Val_, The two READ ONLY accounts that i mentioned were exactly in the MonitorRole.  But they seem do not have the privilege to export the configuration nor ssh-in.  thanks. --david 

[_Val_ · Accepted solution]

Incorrect. You already have built-in monitor user in Gaia. Alternatively, create a new and assign monitorOnly role to it.

This user (you will have to reset its password) is allowed to SSH, CLISH only. It can run "show..." commands. In this context, "show configuration" is what you are looking for.

It will not "export" config out, but will allow auditors to see output of config as part of the ssh session. They can log the session and use the data. 

You do not want to give read-only users access to expert. If you are looking for a capability to send a file out, that is exactly the issue. Expert mode trumps all CLISH restrictions.

[davidso]

thank you!

[_Val_]

you are welcome

[davidso]

according to some experts they mention something adding a RULE to allow these READ ONLY accounts to access SSH and the WEB interface that can serve the same purpose.  Can you please guide me through how to set this rule(s)?  Many Many thanks. --david