Here's this weeks installment of "This Week in CheckMates."

Past and future posts will be available here: About CheckMates 

If you can't wait for the weekly update, follow our Twitter account where threads are highlighted regularly: @CPCheckMates!

Community Highlights

Here are some highlights from the week's activity on CheckMates:

My Top 3 Check Point CLI commands‌

While this was featured last week, it's worth mentioning again as this thread has quickly become one of the most active posts we've had on CheckMates! New commands being added all the time. Have you contributed yours yet?

Check Point Gateway Updates and SHA-256

This issue came up in two different threads:

• Application database update failed 
• UTM-1 Edge NW Failed to load VStream Antivirus signature database (Stage: 4, Error code: 5)  

Check Point switched to using SHA-256 certificates on the systems which gateways fetch various updates from (e.g. for App Control and Anti-Virus signatures). This impacts all Check Point products. To ensure your gateway can receive updates, check your code version jumbo hotfix level against the following SK: Check Point update and online services migration to SHA-256 based certificates 

How-to use Postman with R80 Security Management API  

Postman is a free Google Chrome extension that can be used for testing and experimenting with web-services, such as the Security Management API that was released with R80. A new Postman Collection was added to this thread that will allow you to use Postman with the R80.10 API.

Continuing policy work-in-progress with R80.10 Session Take Over‌

Here's a brief video showing a cool feature in R80.10: the ability to take over a session another administrator has started but didn't commit! We plan to produce additional videos in the near future.

This Week in Threats: Week of July 24th 2017‌

Our Threat Intelligence team has been producing a weekly report that discusses the latest threats for some time now. We are now making these reports available to CheckMates members!

App Control issue with R80 MGMT, 1400 Appliance‌

If you're managing any R77.x gateway (including SMB appliances) with R80.10 and you want to use Application Control/URL Filtering, make sure you are creating and using a separate policy layer for this feature. This is because R77.x gateways do not support unified policy the way R80.10+ gateways do. 

Did You Know...

The forums have RSS feeds?

You can either subscribe to individual spaces or the whole site!

If you go to the relevant space and navigate to the Content section:

You will find an RSS link at the bottom left:

This link can be imported into your RSS reader of choice. 

You'll also notice in the above screenshot that you can get a list of content for the entire site using the link https://community.checkpoint.com/content

Two tips for the price of one

Feedback

You are of course welcome to respond to this post if you have questions! If you want to send something privately, you can send an email to checkmates@checkpoint.com or send a Tweet to @CPCheckMates and we'll respond promptly.

When you want to contribute something or ask a question in CheckMates, do you know in which space to post?

If you have specific feedback one way or the other, please post detailed feedback in the comments.

Two new groups have been created:

• Partners‌
• Authorized Training Centers‌

These are private groups you must request access to.

Click the appropriate link and then click the big "Ask to join this group" button.

A moderator will review your request.

Here's this weeks installment of "This Week in CheckMates."

Past and future posts will be available here: About CheckMates 

Also, if you're not sure what CheckMates is, check out this short video!

Community Highlights

Here are some highlights from the week's activity on CheckMates:

SNORT Rules and CheckPoint R77.30 IPS‌

The question was about having a particular signature trigger a block of the specific IP address for all traffic. This can be done, but it does require building a script that parses the log entry and executes fw samp to block the connection.

Installing take 10 of R80.10 blew away the gateway part of a single gateway setup. Is that a known p...

It appears to be a known issue that can happen under a rare combination of circumstances. Read the thread for a workaround to the issue. A fix for the issue will be coming in a future R80.10 jumbo hotfix.

Issue when migrating R77.30 to R80.10 Management Server ‌

Look for words like "error","fail", and "unable" in the following file: $FWDIR/log/cpm_for_cpdb-YYYY-MM-DD-HH-MM-SS.ELG. You may need to engage with the TAC depending on what this turns up for you.

My Top 3 Check Point CLI commands‌

Chances are, if you've been using Check Point products for a while, you've had to do something on a command line. We've shared some of our favorite (and even obscure) commands with you here. This has quickly become one of our most active threads, chime in with your favorites!

CLI API Example for exporting, importing, and deleting different objects using CSV files (v 00.22.00...‌

This is a great set of scripts for migrating objects in and out of a Check Point R80+ management station using CSV files created by one of our SEs, Eric Beasley‌. Have you used them yet?

Did You Know...

You can control how often you receive email from the community?

We created a short video to explain how, which can also be viewed side-by-side with the captions here: Set Email Notification Prefs in CheckMates | fleeq.io 

Video Link : 5493

Feedback

You are of course welcome to respond to this post if you have questions! If you want to send something privately, you can send an email to checkmates@checkpoint.com and we'll respond promptly.

This is the first of a regular series of posts highlighting activity in the CheckMates community during the past week.

I will also provide a tip that will help you make the best use of CheckMates!

Future posts (planned to be posted on Fridays) will be available here: https://community.checkpoint.com/blog/about-checkmates 

Community Highlights

Here are some highlights from the week's activity on CheckMates:

NotPetya: Under the Microscope Presentation and Recording 

This week, we did our first in a series of "CheckMates Live" webcast. Shortly after the webcast, we made the recording and slides available. However, unlike most content on CheckMates, this content requires you to be signed in to view it.

This is a new poll I created to see what versions of Check Point Management people are using and why. Everyone has their reasons for upgrading (or not). Vote and contribute to the discussion!

CPLogToSyslog Utility Now GA 

This tool, which had been available privately for a number of months, was recently released publicly. There was a question about whether or not BSD logging format was supported. Not by CPLogToSyslog, but via a process described by the following SecureKnowledge article: How to Configure R77.30 Security Gateway on Gaia OS to send Firewall logs to an external Syslog serv...

Centrally Managed Remote Access VPN with Embedded Gaia

There is no specific documentation on this topic because Embedded Gaia platforms are no different than regular Security Gateways when it comes to setting up remote access VPN.

Multiple ISP Redundancy will it support in R80  

This was an older thread that was brought to the surface recently when a customer wondered how to use the ISP Redundancy feature with more than 2 ISPs. The answer in this particular case will likely involve dynamic routing.

Did You Know...

You can use the Jive Daily app to access CheckMates from your mobile device?

While the CheckMates Community site is fairly mobile-friendly, some prefer a native mobile app.

You can download the Jive Daily app for iOS or Android as follows:

• App Store: Jive Daily - Your intranet on the go on the App Store 
• Google Play: Jive Daily: Intranet on the go - Android Apps on Google Play

When prompted, enter community.checkpoint.com as the community and sign in with your User Center credentials.

Feedback

You are of course welcome to respond to this post if you have questions! If you want to send something privately, you can send an email to checkmates@checkpoint.com and we'll respond promptly.