The CheckMates Blog

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

Community Highlights

Here are the threads to watch from the last week:

Firewall Allowing Traffic Without Access Policy

Beware of implied rules.

SmartConsole Object Problem on Windows 1903

Microsoft updated .NET to version 4.8, which is causing some issues.

Example Gaia FTW cloud-init User Data for Blink Enabled and Legacy config_system Images

Should make it easier to auto-setup new installations.

Check Point Gateway Cores and FW Workers

Some basics on allocating cores with CoreXL.

SIP Over TLS Non Standard Ports

Kind of an odd one that had a simple fix.

Understanding URL Filtering and App Control on HTTPS Sites

The destination host shown in the logs may not be exactly how URL Filtering saw the connection.

Office Mode IP Failure

There are a couple reasons for this.

How to Read Log Files Once Offloaded

They need to be loaded on another management server and be indexed.

When Will Check Point Support the Load Sharing Mode in either R80.20 or R80.30?

Our VP of Products provides the definitive answer.

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 
Here's where you can find @Valeri_Loukine and I over the next few weeks

• 29th July 2019: Check Point R80.x API Best Practices in Fort Lauderdale with @PhoneBoy 
• 31st July 2019: Check Point R80.x API Best Practices in Orlando with @PhoneBoy 
• 1st August 2019: Check Point R80.x API Best Practices in Tampa with @PhoneBoy 
• 14th August 2019: TechTalk: Check Point and the MITRE ATT&CK Framework
• 28th August 2019: SD-WAN Security TechTalk
• 3 September 2019: CheckMates Live Vienna with @Valeri_Loukine 

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

CheckMates Around The World

Been a while since I've shared photos of events, but it's been quite a busy last several weeks.

Earlier in July, I did our first events in the Caribbean! Had nice crowds in Trinidad and Barbados. 

Meanwhile, @_Val_ did our first event in Minsk this past week to an enthusiastic crowd!

Community Highlights

Here are the threads to watch from the last week:

Not Able to Find the Serial Number

While we've had the ability to query at the OS level for a serial number for a while now, this doesn't work on some older appliances.

GeoProtection Daily Update Issue From July 10th

This caused some customers issues. Here's the official story on what happened.

Is It Possible to Change an Interface MAC Address?

You can temporarily anyway.

Can I Replace Conventional Antivirus Kaspersky with Check Point Endpoint Suite

Why, yes you can.

Maestro TechTalk

Get the answers to your burning questions about Maestro.

Version R77.20.87 Build 990172938 Not Documented

Discussion around TCP SACK fixes for SMB appliances

My Top 3 Check Point CLI Commands

This 2 year old post by @Moti is by far our most popular post on CheckMates, and it's still getting replies!

When Will Check Point Support Load Sharing in R80.20 or R80.30?

It's coming soon for R80.30.

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 
Here's where you can find @Valeri_Loukine and I over the next few weeks

• 29th July 2019: Check Point R80.x API Best Practices in Fort Lauderdale with @PhoneBoy 
• 31st July 2019: Check Point R80.x API Best Practices in Orlando with @PhoneBoy 
• 1st August 2019: Check Point R80.x API Best Practices in Tampa with @PhoneBoy 
• 14th August 2019: TechTalk: Check Point and the MITRE ATT&CK Framework
• 28th August 2019: SD-WAN Security TechTalk
• 3 September 2019: CheckMates Live Vienna with @_Val_ 

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

Community Highlights

Here are the threads to watch from the last week:

New Releases

• R80.20 New Management Image is Now Available as a GA Release
• R80.20 Jumbo Hotfix Accumulator New GA Take 87

CheckMates Member of the Month for July 2019: Nicholas Doropoulos

Put your virtual hands together!

Behavior of HA Cluster When SYN Link is Down

A bonded sync link is a good idea.

One Liner Collection

Similar to My Top 3 CLI Commands but it lists posts that reference some more complicated CLI foo.

High Dispatcher CPU

How to troubleshoot.

High CPU on Allowed But Unknown Traffic

Similar to the previous thread, but involving VSX.

Win10 E80.85 Endpoint Patching VPN Connection Lost July Updates

If you're applying Windows 10 updates, make sure the Endpoint Security client is also updated as well.

Unable to Connect to McAfee SIEM via LEA After Upgrade to R80.20

Some changes were made in R80+ with regards to OPSEC, make sure your third party products have been updated.

Check Point OS Download

Explaining the various options.

Parsing The Output of "mgmt_cli" Using jq

An oldie but goodie that periodically comes up.

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 
Here's where you can find @Valeri_Loukine and I over the next few weeks

• 16th July 2019: CheckMates Live Belarus with @_Val_ 
• 17th July 2019: Maestro TechTalk: New Features, Best Practices, and Performance Aspects
• 14th August 2019 TechTalk: Check Point and the MITRE ATT&CK Framework
• 28th August 2019: SD-WAN Security TechTalk

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com 

It's that time of the month where we recognize our best members. Put your virtual hands together for @Nick_Doropoulos, our CheckMates member of the Month for July 2019!

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

Community Highlights

Here are the threads to watch from the last week:

How-To Videos

• Oracle Cloud Cluster Deployment
• Integrating Check Point Identity-Based Access into Cisco ISE
• Learn about Anti-Bot
• Defending Against the Emotet Malware Campaign

Software Releases

• R80.30 First Jumbo HFA is Now Available
• R80.30 3.10 For CloudGuard & Open Servers is GA

Gaia R80.10 VLAN 1 and Native VLAN

Not supported, but the discussion here did lead to improving our documentation around this.

Log Fields Full Mapping SK

We've had a few requests for this.

Functionality API vs SmartConsole

Not everything's available via API yet.

R80.20 MTU and SecureXL Problem

Something to track.

Password Reset Collection

This topic has come up a few times in the last few weeks.

SMB Documents

Collection of very helpful docs related to our 600/700/1100/1200R/1400 Appliances

My Security Management Setup Script

An oldie but goodie that might be good for building your own "Demo Mode" environment.

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 
Here's where you can find @Valeri_Loukine and I over the next few weeks

• 9th July 2019: CheckMates Live Trinidad with @PhoneBoy 
• 9th July 2019: CheckMates Live Turkey with @Valeri_Loukine 
• 11th July 2019: CheckMates Live Barbados with @PhoneBoy 
• 17th July 2019: Maestro TechTalk: New Features, Best Practices, and Performance Aspects
• 14th August 2019 TechTalk: Check Point and the MITRE ATT&CK Framework
• 28th August 2019: SD-WAN Security TechTalk

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com 

Hi CheckMates ,

This is your opportunity to influence and shape how the 2020 CPX 360 agenda and content will look like .

We wish to create the best ever and most relevant event to today and future cyber security challenges and solutions.

Please share with us your feedback and ideas by answering this short survey and for your chance to win Apple Air Pods!

Feel free to forward the survey link (http://tiny.cc/cpx2020cool  ) to your colleagues 

All for now and c ya there 🙂 

Moti 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

Community Highlights

Here are the threads to watch from the last week:

New Releases

• R80.20 JHF 87 (Ongoing)
• Management Jumbo Hotfixes -- Did You Know?

CPX 360 2020

We're getting a head start on our next big CPX 360 events!

• Call for Papers CPX 360 2020
• CPX 360 2020 Content Survey

RDP Nightmares

Our latest episode of the CheckMates GO podcast

"cpconfig" => "Administrator" does not show the options to list all admins

Admins have been configured in SmartConsole/Dashboard for a while now, cpconfig is a legacy option.

policyCleanUp.py Issue

The issue was the default API port was changed from 443. That means all your scripts and API calls must use the port you've configured.

Introduction to Identity-Based Access Control and Threat Prevention

Another good video from @Peter_Elmer

Rulebase Policy Export from Gateway

It's much easier to do this from the management if at all possible.

SIP NATing Fills up fwx_alloc Even When There's No NAT used for SIP

SIP Early NAT is at play here.

AD Query Server Connection

Make sure you've enabled connectivity between the gateway and the AD server.

VPN Usage Report

A few threads are highlighted in here.

Custom View Report for Application Usage Broken Out By Week Over Time

Requires some work in Excel in addition to the correct SmartEvent report.

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 
Here's where you can find @Valeri_Loukine and I over the next few weeks

• 9th July 2019: CheckMates Live Trinidad with @PhoneBoy 
• 9th July 2019: CheckMates Live Turkey with @Valeri_Loukine 
• 11th July 2019: CheckMates Live Barbados with @PhoneBoy 
• 17th July 2019: Maestro TechTalk: New Features, Best Practices, and Performance Aspects
• 14th August 2019 TechTalk: Check Point and the MITRE ATT&CK Framework
• 28th August 2019: SD-WAN Security TechTalk

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com