The CheckMates Blog

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

Community Highlights

Here are the threads to watch from the last week:

Dynamic CLI and Gaia APIs TechTalk and Q&A

If you missed it, the recording and slides are here.

Is It Possible to Export and Import Host Objects?

Of course it is.

Details of Fields Logged

We don't have a comprehensive document, but Log Exporter has some of it documented.

Legacy Auth on R80.10 Gateways

It works, but you should really move to Identity Awareness.

Why are some IPS Signatures Inactive?

Check the Threat Prevention profile settings.

Why Do We See Logs on Rules Which Are Not Installed Yet?

It's a feature.

Updateable Objects and NAT

Apparently, this is also a feature.

Publish and Install Difference

For those new to R80.x.

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

CheckMates in Russia, Kazakhstan, and Canada

The CheckMates team was busy getting the word out all over the world! @_Val_ was in Moscow and Almaty:

And #FlatMoti and I were in Quebec City, Ottawa, and Montreal

Community Highlights

Here are the threads to watch from the last week:

Finding Root Cause for all the F2F Traffic

Does require digging into the configuration a bit.

Use of Private ThreatCloud behind Load Balancer

Didn't realize this was possible.

IPS, Follow-Up, and Staging

How these worked changed from R77.x to R80.x.

Check SIC Status Without SmartConsole

cprid_util to the rescue

2019 Job Task Analysis Survey

This will help our Training and Certification team

Does the 4600 Appliance with 4GB of RAM Support R80.20?

Yes, it does.

Gaia Backup All Clish Configs From All Gateways With a Single CLI Command

Neat trick!

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 
Upcoming events include:

• April 26th:
  • TechTalk: Gaia APIs -- Fast and Simple Gateway Configuration

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

Busy Week Coming Up

@_Val_ and I were NOT on the road this past week, but we've both got full dance cards coming up. In addition, there are also CheckMates events happening in Denver next week. See the complete list below! 

Community Highlights

Here are the threads to watch from the last week:

Latest Releases

• CloudGuard IaaS support for AWS Transit GW
• New GA SmartConsole (Build #46) for R80.20 is available
• R80.20 Jumbo Hotfix Accumulator - New Ongoing Take #73

CheckMates Member of the Month for April 2019: Jerry Szpinak

Been quite a while since we've done one of these.

Easy execute CLI commands from management on gateways!

This has been possible for a while, this just puts a "familiar" interface on it.

Logical Interface as Next Hop for Routes on Cluster Members that DO NOT use VIPs in Different Subnet

This is generally not a good idea.

Show Total Number of Objects in Database For R77.x and Earlier

Pretty easy with the ye olde objects_5_0.C

Jumbo Hotfix Versions Between Firewall and Management

Ideally they should be the same or higher.

Missing Cleanup Rule When a Rule is Definitely Set

A cleanup rule has a fairly specific definition.

Nat Rule over Tunnel/Community

If you want to do NAT across a VPN, make sure you haven't disabled it in the community.

Configuration Migration From 4200 Appliance to 4800 Appliance

While trying to maintain similar versions.

Fetch Changed Policy from Management to Gateway

When the existing policy doesn't let you fetch it.

Cannot Connect with SmartConsole to R77.30 or Earlier Management

It keeps coming up as people do fresh installs of R77.30 and earlier.

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 
Upcoming events include:

• April 16th:
  • Moscow CheckMates Live April 2019
  • Technology Updates from CPX360 Live in Quebec City!
  • Automate Security Management, Incident Response War Stories, & Solutions Overview in Westminster, CO
• April 17th:
  • Technology Updates from CPX360 Live in Ottawa!
  • Automate Security Management, Incident Response War Stories, & Solutions Overview in Lone Tree, CO
• April 18th:
  • Migrate to R80.x Live in Almaty! 
  • Technology Updates from CPX360 Live in Montreal!
• April 26th:
  • TechTalk: Gaia APIs -- Fast and Simple Gateway Configuration

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com 

It has been an embarrassingly long time since we've recognized great contributors to the CheckMates community! Time to get back to doing it.

Put your virtual hands together for @Jerry , our CheckMates member of the Month for April 2019!

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

CheckMates in Vienna and Salzburg

@_Val_ did events in Vienna and Salzburg. Only got one picture from both events:

Community Highlights

Here are the threads to watch from the last week:

CheckMates GO Episode 1: Threat Intelligence

We've launched our new podcast, CheckMates GO! Look for it in iTunes, Google Play, or wherever finer podcasts are procured!

Problem with adding threat indicator via Web Services API

Remember to always use the publish action when using the API.

How am I Seeing Application-Specific Logs Without HTTPS Inspection?

There are pros and cons to doing this without HTTPS Inspection. This will get easier in R80.30 with SNI support.

R80.20 Validation Error: IP Protocol value must be in the range 1-255

It's an easy fix, but the error message is misleading.

R7x / R8x Installation Differences

Some observations 

Is http/https proxy needed to replace old proxy with Check Point gateway?

Depends on the environment you're in.

IPS Exception Not Working

There are a few places you set exceptions in R80.x.

How to determine top talker host IP

Useful for older gateways.

R80.10 and Java Compatibility for Firefox and Chrome

Some discussion around this new feature coming soon.

What is DLE?

I had to look this one up myself...

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 
Upcoming events include:

• April 16th:
  • Moscow CheckMates Live April 2019
  • Technology Updates from CPX360 Live in Quebec City!
  • Automate Security Management, Incident Response War Stories, & Solutions Overview in Westminster, CO
• April 17th:
  • Technology Updates from CPX360 Live in Ottawa!
  • Automate Security Management, Incident Response War Stories, & Solutions Overview in Lone Tree, CO
  • Moscow CheckMates Live
• April 18th:
  • Migrate to R80.x Live in Almaty! 
  • Technology Updates from CPX360 Live in Montreal!
• April 26th:
  • TechTalk: Gaia APIs -- Fast and Simple Gateway Configuration

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

@_Val_ had a pretty full dance card this week, doing events in Madrid, Portugal, and Bunnik:

Me? I went to Tulsa:

And CheckMates was on the menu at Stoney River Steakhouse in Nashville courtesy of @Adam_Forester!

Community Highlights

Here are the threads to watch from the last week:

New Software Releases

• R80.20 JHF 47 (GA Take)
• R80.10 JHF 203 (Ongoing Take)
• SandBlast Agent E80.94

Rate & Review SandBlast Mobile Protect

Aside from sharing your feedback on CheckMates, of course, please let us know how you like SandBlast Mobile Protect on the various app stores.

Ansible Demo with R80.20 Gateways and Management

An updated version of an older demo, but now with current versions.

Max Concurrent Sessions Per Connection Exceeded Quota

Certain protocol inspections have a quota associated with them.

TechBytes: Remote Access

A how-to on setting up remote access.

Keeping Policy Templates with no Policy Install Targets

You might not want to keep a layer with a policy installation target of All. If you specify "Specific" then you have to put something there. Here's how to make it empty.

Automation for Newbies: Ansible and Terraform

A new demo involving Ansible and Terraform.

Can the 3200 Appliance Be Managed Locally?

Can it? Yes. Should it? Different question.

Activate PFS in a Community via API

No official API for it, but it can be done.

Show Changes in a Single Session

It can be done via API, yes. In R80.30, a SmartConsole Extension will be available that will generate a Policy Change Report.

API - Adding Network Objects with the same IP as Others Already Created

Not by default, but it can be done.

Move IPS Profile Rules to Threat Prevention Layer

One of those tasks you'll have to perform after you upgrade your gateways to R80.x.

Access Serial Console of Another Device thru Check Point Appliance USB port

This is a neat trick!

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 
Upcoming events include:

• April 2nd: CheckMates Live in Vienna! 
• April 3rd: CheckMates Live in Salzburg! 
• April 16th:
  • Moscow CheckMates Live April 2019
  • Technology Updates from CPX360 Live in Quebec City!
  • Automate Security Management, Incident Response War Stories, & Solutions Overview in Westminster, CO
• April 17th:
  • Technology Updates from CPX360 Live in Ottawa!
  • Automate Security Management, Incident Response War Stories, & Solutions Overview in Lone Tree, CO
  • Moscow CheckMates Live
• April 18th:
  • Migrate to R80.x Live in Almaty! 
  • Technology Updates from CPX360 Live in Montreal!

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com