- Products
- Learn
- Local User Groups
- Partners
-
More
Join Us for CPX 360
23-24 February 2021
Important certificate update to CloudGuard Controller, CME,
and Azure HA Security Gateways
How to Remediate Endpoint & VPN
Issues (in versions E81.10 or earlier)
IDC Spotlight -
Uplevel The SOC
Important! R80 and R80.10
End Of Support around the corner (May 2021)
Running into "get interfaces with topology" feature problem recently due to route mismatch on cluster members prompted me to write a quick one-liner to compare routes with least possible effort.
It must be noted for example simplicity I used SNMP V1 with public community (which is not advisable in production) so update command snmp part in red accordingly. Also it does require that SNMP port is open on Sync interface (IPs from cphaprob stat output)
For example below I added a dummy 1.1.1.1/32 route to FW1
[Expert@fw1:0]# i=0; cphaprob stat | egrep ^[1,2] | sed 's/(local)//' | awk '{print $2}'| while read line; do let i++; snmpwalk -c public -v 1 $line IP-FORWARD-MIB::inetCidrRouteIfIndex.ipv4 | awk -F\" '{print $2, $4, substr($3,2,2)}' > fw.$i; done; if [ `diff -q fw.1 fw.2 | wc -l` -gt 0 ]; then diff fw.1 fw.2; else echo "Routes OK"; fi
2d1
< 1.1.1.1 10.3.81.67 32
NormaL output would be
[Expert@fwfran1:0]# i=0; cphaprob stat | egrep ^[1,2] | sed 's/(local)//' | awk '{print $2}'| while read line; do let i++; snmpwalk -c public -v 1 $line IP-FORWARD-MIB::inetCidrRouteIfIndex.ipv4 | awk -F\" '{print $2, $4, substr($3,2,2)}' > fw.$i; done; if [ `diff -q fw.1 fw.2 | wc -l` -gt 0 ]; then diff fw.1 fw.2; else echo "Routes OK"; fi
Routes OK
Great solution Kaspar!
It's a useful tip when Cloning Groups are not in use. For cluster enviroments the best is configure a Cloning Group that follows ClusterXL to sync all routing related parameters.
Regards.
absolutely (about cloning groups) but there are some reasons that I'm not able to discuss here why we are not doing it
About CheckMates
Learn Check Point
Advanced Learning
WELCOME TO THE FUTURE OF CYBER SECURITY