The CheckMates Blog - Page 18

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

Community Highlights

Here are the threads to watch from the last week:

New Releases

• R80.30 with Linux 3.10 Kernel Early Availability
• Google Cloud Platform High Availability Solution is GA
• CloudGuard SaaS April 2019 Upgrade

CheckMates GO Episode 3: Threat Intelligence

Wonder when I'm going to make my way onto one of these podcasts 😁

Do I Need Proxy Rule About the Stealth Rule?

Yup.

Manually Define Local VPN Domain Per Remote Peer

We'll make this something in SmartConsole soon, hopefully.

Is It Possible to Change Settings for How Application Control Works?

It's not an issue with Application Control per-se, but an issue with parsing certain HTTP traffic when Application Control is invoked.

Cannot Remove IPS Blade from Gateway Object

Make sure your Threat Prevention policy isn't too specific.

2200 Appliances and R80.20 Support

Assuming you have 4GB of RAM, it works.

Disk Space Management Seems Not to Be Working

Make sure to account for the 5% reserve that is typical in Unix filesystems.

Script to Delete A Specific Tag from All Objects

A case of "ask and you shall receive."

New Unified API Reference

Currently contains only Management and Gaia APIs, but will be updated to include the others soon.

Rulebase Audit Based on Date

Shows rules that are older than 365 days.

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 
Here's where you can find @_Val_ and I over the next few weeks

• 16th May 2019: CPX Miami 
• 22nd May 2019: WatchTower Mobile Security Management TechTalk
• 18th June 2019: CheckMates Live Estonia
• 19th June 2019: SD-WAN Security TechTalk
• 17th July 2019: Maestro TechTalk: New Features, Best Practices, and Performance Aspects

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

Community Highlights

Here are the threads to watch from the last week:

Dynamic CLI and Gaia APIs TechTalk and Q&A

If you missed it, the recording and slides are here.

Is It Possible to Export and Import Host Objects?

Of course it is.

Details of Fields Logged

We don't have a comprehensive document, but Log Exporter has some of it documented.

Legacy Auth on R80.10 Gateways

It works, but you should really move to Identity Awareness.

Why are some IPS Signatures Inactive?

Check the Threat Prevention profile settings.

Why Do We See Logs on Rules Which Are Not Installed Yet?

It's a feature.

Updateable Objects and NAT

Apparently, this is also a feature.

Publish and Install Difference

For those new to R80.x.

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

CheckMates in Russia, Kazakhstan, and Canada

The CheckMates team was busy getting the word out all over the world! @_Val_ was in Moscow and Almaty:

And #FlatMoti and I were in Quebec City, Ottawa, and Montreal

Community Highlights

Here are the threads to watch from the last week:

Finding Root Cause for all the F2F Traffic

Does require digging into the configuration a bit.

Use of Private ThreatCloud behind Load Balancer

Didn't realize this was possible.

IPS, Follow-Up, and Staging

How these worked changed from R77.x to R80.x.

Check SIC Status Without SmartConsole

cprid_util to the rescue

2019 Job Task Analysis Survey

This will help our Training and Certification team

Does the 4600 Appliance with 4GB of RAM Support R80.20?

Yes, it does.

Gaia Backup All Clish Configs From All Gateways With a Single CLI Command

Neat trick!

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 
Upcoming events include:

• April 26th:
  • TechTalk: Gaia APIs -- Fast and Simple Gateway Configuration

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

Busy Week Coming Up

@_Val_ and I were NOT on the road this past week, but we've both got full dance cards coming up. In addition, there are also CheckMates events happening in Denver next week. See the complete list below! 

Community Highlights

Here are the threads to watch from the last week:

Latest Releases

• CloudGuard IaaS support for AWS Transit GW
• New GA SmartConsole (Build #46) for R80.20 is available
• R80.20 Jumbo Hotfix Accumulator - New Ongoing Take #73

CheckMates Member of the Month for April 2019: Jerry Szpinak

Been quite a while since we've done one of these.

Easy execute CLI commands from management on gateways!

This has been possible for a while, this just puts a "familiar" interface on it.

Logical Interface as Next Hop for Routes on Cluster Members that DO NOT use VIPs in Different Subnet

This is generally not a good idea.

Show Total Number of Objects in Database For R77.x and Earlier

Pretty easy with the ye olde objects_5_0.C

Jumbo Hotfix Versions Between Firewall and Management

Ideally they should be the same or higher.

Missing Cleanup Rule When a Rule is Definitely Set

A cleanup rule has a fairly specific definition.

Nat Rule over Tunnel/Community

If you want to do NAT across a VPN, make sure you haven't disabled it in the community.

Configuration Migration From 4200 Appliance to 4800 Appliance

While trying to maintain similar versions.

Fetch Changed Policy from Management to Gateway

When the existing policy doesn't let you fetch it.

Cannot Connect with SmartConsole to R77.30 or Earlier Management

It keeps coming up as people do fresh installs of R77.30 and earlier.

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 
Upcoming events include:

• April 16th:
  • Moscow CheckMates Live April 2019
  • Technology Updates from CPX360 Live in Quebec City!
  • Automate Security Management, Incident Response War Stories, & Solutions Overview in Westminster, CO
• April 17th:
  • Technology Updates from CPX360 Live in Ottawa!
  • Automate Security Management, Incident Response War Stories, & Solutions Overview in Lone Tree, CO
• April 18th:
  • Migrate to R80.x Live in Almaty! 
  • Technology Updates from CPX360 Live in Montreal!
• April 26th:
  • TechTalk: Gaia APIs -- Fast and Simple Gateway Configuration

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com 

It has been an embarrassingly long time since we've recognized great contributors to the CheckMates community! Time to get back to doing it.

Put your virtual hands together for @Jerry , our CheckMates member of the Month for April 2019!

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

CheckMates in Vienna and Salzburg

@_Val_ did events in Vienna and Salzburg. Only got one picture from both events:

Community Highlights

Here are the threads to watch from the last week:

CheckMates GO Episode 1: Threat Intelligence

We've launched our new podcast, CheckMates GO! Look for it in iTunes, Google Play, or wherever finer podcasts are procured!

Problem with adding threat indicator via Web Services API

Remember to always use the publish action when using the API.

How am I Seeing Application-Specific Logs Without HTTPS Inspection?

There are pros and cons to doing this without HTTPS Inspection. This will get easier in R80.30 with SNI support.

R80.20 Validation Error: IP Protocol value must be in the range 1-255

It's an easy fix, but the error message is misleading.

R7x / R8x Installation Differences

Some observations 

Is http/https proxy needed to replace old proxy with Check Point gateway?

Depends on the environment you're in.

IPS Exception Not Working

There are a few places you set exceptions in R80.x.

How to determine top talker host IP

Useful for older gateways.

R80.10 and Java Compatibility for Firefox and Chrome

Some discussion around this new feature coming soon.

What is DLE?

I had to look this one up myself...

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 
Upcoming events include:

• April 16th:
  • Moscow CheckMates Live April 2019
  • Technology Updates from CPX360 Live in Quebec City!
  • Automate Security Management, Incident Response War Stories, & Solutions Overview in Westminster, CO
• April 17th:
  • Technology Updates from CPX360 Live in Ottawa!
  • Automate Security Management, Incident Response War Stories, & Solutions Overview in Lone Tree, CO
  • Moscow CheckMates Live
• April 18th:
  • Migrate to R80.x Live in Almaty! 
  • Technology Updates from CPX360 Live in Montreal!
• April 26th:
  • TechTalk: Gaia APIs -- Fast and Simple Gateway Configuration

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

@_Val_ had a pretty full dance card this week, doing events in Madrid, Portugal, and Bunnik:

Me? I went to Tulsa:

And CheckMates was on the menu at Stoney River Steakhouse in Nashville courtesy of @Adam_Forester!

Community Highlights

Here are the threads to watch from the last week:

New Software Releases

• R80.20 JHF 47 (GA Take)
• R80.10 JHF 203 (Ongoing Take)
• SandBlast Agent E80.94

Rate & Review SandBlast Mobile Protect

Aside from sharing your feedback on CheckMates, of course, please let us know how you like SandBlast Mobile Protect on the various app stores.

Ansible Demo with R80.20 Gateways and Management

An updated version of an older demo, but now with current versions.

Max Concurrent Sessions Per Connection Exceeded Quota

Certain protocol inspections have a quota associated with them.

TechBytes: Remote Access

A how-to on setting up remote access.

Keeping Policy Templates with no Policy Install Targets

You might not want to keep a layer with a policy installation target of All. If you specify "Specific" then you have to put something there. Here's how to make it empty.

Automation for Newbies: Ansible and Terraform

A new demo involving Ansible and Terraform.

Can the 3200 Appliance Be Managed Locally?

Can it? Yes. Should it? Different question.

Activate PFS in a Community via API

No official API for it, but it can be done.

Show Changes in a Single Session

It can be done via API, yes. In R80.30, a SmartConsole Extension will be available that will generate a Policy Change Report.

API - Adding Network Objects with the same IP as Others Already Created

Not by default, but it can be done.

Move IPS Profile Rules to Threat Prevention Layer

One of those tasks you'll have to perform after you upgrade your gateways to R80.x.

Access Serial Console of Another Device thru Check Point Appliance USB port

This is a neat trick!

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 
Upcoming events include:

• April 2nd: CheckMates Live in Vienna! 
• April 3rd: CheckMates Live in Salzburg! 
• April 16th:
  • Moscow CheckMates Live April 2019
  • Technology Updates from CPX360 Live in Quebec City!
  • Automate Security Management, Incident Response War Stories, & Solutions Overview in Westminster, CO
• April 17th:
  • Technology Updates from CPX360 Live in Ottawa!
  • Automate Security Management, Incident Response War Stories, & Solutions Overview in Lone Tree, CO
  • Moscow CheckMates Live
• April 18th:
  • Migrate to R80.x Live in Almaty! 
  • Technology Updates from CPX360 Live in Montreal!

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

A Relatively Quiet Week

For me, at least, most of this week was focused on tuning up the new community after the migration. Some minor visual improvements were made this week in response to feedback, including adding some useful message views to the More menu.  The new platform and the number of hands involved means it takes a little longer to roll out enhancements. More is coming soon, so bear with us.

One thing we did add this past week was a dedicated space for the VSX product. Some might say it's long overdue, and you're right. We've had a lot of VSX-specific threads over the last couple years, and now we have a specific space to put them in!

Community Highlights

Here are the threads to watch from the last week:

Member Exclusive TechBytes

Some of our Sales Engineers are doing education sessions, which we are now making available in our Member Exclusive area!

R80.x Architecture and Performance Tuning Link Collection

A link to several useful articles from @HeikoAnkenbrand !

Blocking Pornography without HTTPS Inspection

There are pros and cons to doing this without HTTPS Inspection. This will get easier in R80.30 with SNI support.

Migrate to 10G Interfaces

Coming from 1GB interfaces, there are a couple things to do.

Keeping Policy Templates with no Policy Install Targets

You might not want to keep a layer with a policy installation target of All. If you specify "Specific" then you have to put something there. Here's how to make it empty.

Check Point Automation: Many Questions

With some answers, of course.

R77.20.86 for SMB Appliances

The biggest thing this enables is the WatchTower app from your mobile device. 

Check Point Rulebase: Is there any kind of implicit or explicit rule above stealth rule except manag...

There are a few, yes.

R80.20 Management and VPN Domain with EDGE N Appliances

If you're still managing EDGE N appliances with R80.20, watch out for this one!

New! R80.30 feature: Management Data Plane Separation (For Gateways with 8+ cores)

Some discussion around this new feature coming soon.

Service type "Service with Resource" via the Management API

These are legacy service types, and thus their API support is...limited.

Management R80.20 Instability

Are you having issues? We want to hear about it!

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 
Upcoming events include:

• Mar 26th:
  • Migrate to R80.x Live in Madrid!
  • Cloud Control Plane Security with CloudGuard Dome9 in Nashville
• Mar 27th:
  • Migrate to R80.x Live in Lisbon! 
  • Automate Security Management and Protect Your Clouds in Tulsa
• Mar 28th: Migrate to R80.x Live in Bunnik! 
• April 2nd: CheckMates Live in Vienna! 
• April 3rd: CheckMates Live in Salzburg! 
• April 16th:
  • Moscow CheckMates Live April 2019
  • Technology Updates from CPX360 Live in Quebec City!
• April 17th: Technology Updates from CPX360 Live in Ottawa!
• April 18th:
  • Migrate to R80.x Live in Almaty! 
  • Technology Updates from CPX360 Live in Montreal! (Link coming soon)

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!
Past and future posts will be available here: The CheckMates Blog
To have these updates show up in your preferred RSS reader add the following URL: The CheckMates Blog RSS Feed
See also our social media accounts and our podcast (RSS Feed)

What Happened This Week? A Lot.

@_Val_ did a CheckMates Live event in Ireland and I did two in Denmark with @Oren_Koren and Avishai Duer:

The major thing that happened this past week was the migration to the new community platform, something that was at least a year in the making:

As with any migration of this nature, a few challenges were encountered. Not all the data could be migrated automatically, like the videos, which will be migrated by hand. The features aren't exactly the same as the old platform. Some things in the site design need tweaking. Nerd knobs need turning. There's definitely more work to do in order to make this new place feel like home.

We will rapidly iterate to address the various issues you've told us about and we've encountered ourselves. As we're big on transparency, we'll do our best to keep you all informed as improvements are made. Keep your feedback coming, positive or negative!

Info about the new platform we've shared so far:

• Welcome to the Next Generation of CheckMates
• New Lithium Ranks
• Badges are Live
• Platform URLs You'll Find Useful

Community Highlights

Despite the challenges caused by the migration, there was no shortage of conversations in the community this week:

Ultimate Collection of Check Point Links

This is a post @_Val_ put together a few months back that I just spent a lot of time with to update all the links and to ensure the videos were uploaded. Lots of great stuff here if you're just starting out with Check Point!

Multiple clish Commands from R80 Script Repository Possible?

There are ways, yes.

API with MDS Environment

When working with the API, remember to publish when you make changes, MDS or otherwise.

Is It Possible to Get an Overview of All Traffic to a Specific Country?

In R80.20, yes.

R80.20 Fresh Install to Sandbox TE100X Appliance has Kernel 2.6, Is It Normal?

For the moment, yes.

Establishing Trust Based on Signed Certificates Between Cisco ISE and Identity Collector

A how-to document.

Security Management: Videos and Hands-On Lab Booklet from CPX

If you didn't go to CPX 360 this year, here's one of the things you missed!

R80.20 Management in VMware

What basic settings you need.

Where Used between HTTPS Inspection and SmartConsole

If you use HTTPS Inspection on R80.x, watch out for this one!

Monitoring of Connection Tables

Doing it remotely via SNMP or similar.

Adding a Third 5800 to a Current 5800 Firewall Cluster

Some things to keep in mind here.

Linux for Check Point

While not strictly required, it's helpful to know some.

Upcoming Events

We are now maintaining our event calendar in Google Calendar.
You can browse our calendar of events here: CheckMates Calendar 
Upcoming events include:

• Mar 20th: Running VSX like a Pro TechTalk 
• Mar 26th:
  • Migrate to R80.x Live in Madrid!
  • Cloud Control Plane Security with CloudGuard Dome9 in Nashville
• Mar 27th:
  • Migrate to R80.x Live in Lisbon! 
  • Automate Security Management and Protect Your Clouds in Tulsa
• Mar 28th: Migrate to R80.x Live in Bunnik! 
• April 2nd: CheckMates Live in Vienna! 
• April 3rd: CheckMates Live in Salzburg! 
• April 18th: Migrate to R80.x Live in Almaty! 

If you would like a CheckMates Live event in your area, get in contact with us: checkmates@checkpoint.com 

On behalf of the entire CheckMates team, I'd like to welcome you onboard our next generation cyber security community! Here on the community, we only want the best for our CheckMaters. We aspire to continuously keep you in the know about the latest cyber security trends, knowledge, and best practices so you can make your part of the world a safer place.

So what's new? Here are the highlights:

• Navigate through new menus and explore the modern look and feel
• Filter through various Check Point products and learn about their unique features and tools
• Customize and manage your view through Recent, Popular and Featured posts
• Be part of the new points and badges system; reward your peers and be rewarded
• Enjoy the enhanced private messaging tool to build connections with your peers near and far*
• And as a mobile responsive platform, you can now login to CheckMates from any corner of the world

As always, don’t hesitate to get in touch with the CheckMates team to share your feedback with us.

* Only available to users with rank Iron or above.