Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!

Past and future posts will be available here: About CheckMates

To have these updates show up in your preferred RSS reader add the following URL: About CheckMates RSS Feed 

See also our social media accounts and our podcast (RSS Feed😞

CheckMates in Your Language!

While most of the content on CheckMates is in English, we now have a few groups where both content and discussions are available in other languages! 

• CheckMates in Russian - ЧекМейтс по-русски
• CheckMates en Français
• CheckMates Taiwan論壇

Christmas with the CheckMates Team

Happy Holidays from the CheckMates team!

Niran Turgeman‌ got us into the spirit by "elfing" us.

Community Highlights

Here are the conversations worth watching in the community:

R80.20.M2 Now Available 

Just in time for Christmas!

R80.20 security checkup report does not export 

There's a fix for this issue.

Domain-Based VPN with Dynamic Routing 

Can you disable the VPN routes? Yes you can.

Mapping Rule numbers from R80.20 to fwaccel stat output 

You can look at the compiled rulebase, but it might be in the backward compatibility directories.

How to see what firewall rules match some traffic 

This is when you're not sure what rule will match traffic.

SecureXL Connections Table 

Did you know SecureXL maintains its own connections table? Now you do.

Does R80.10 Identity Collector work with Cisco ISE 2.4 

Wasn't QAed, but it should work.

Reports on 730 Appliances  

Reports related to applications only work if the Application Control blade is enabled.

Update 15400 r77.30 to r80.20 

Have you done this? What's your experience?

Site-to-site vpn Tunnel to a non Checkpoint Gateway 

Debugging tips

BEYOND - Customer Success Hub 

We're still working through some issues with the new support hub.

Upcoming Events

• 9th January 2019: New Years Toast and Migrate to R80.20 
• 15th January 2019: Introduction to Check Point R80.x API in Memphis‌
• 5th March 2019: Check Point R80.20 Updates, Troubleshooting and Support Best Practices, Live in Bratislava!

And, of course, CPX 360 2019!

Hi CheckMates!

If you haven’t yet registered for CPX 360, the top cybersecurity event of the year ever to exist, NOW is your chance!

Join us this year to meet, learn and laugh with your fellow CheckMaters, Check Point experts and top cybersecurity professionals. From CyberTalks, Breakout Sessions, Awards and the CheckMates Scavenger Hunt, you wouldn’t want to miss out!

Register for CPX 360 before Friday, January 4th, and you’ll be given exclusive access to the CPX CheckMates Lounge where you can meet top Check Point R&D specialists and you’ll be entered into a raffle to WIN an Apple Watch 4!

Register below before Friday, January 4th:

• CPX Bangkok: Jan 21-23
  • CPX Las Vegas: Feb 4-7
  • CPX Vienna: Feb 18-21

To redeem your rewards, email The CheckMates Team with your registration confirmation.

Don't miss out, see you there!

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!

Past and future posts will be available here: About CheckMates

To have these updates show up in your preferred RSS reader add the following URL: About CheckMates RSS Feed 

See also our social media accounts and our podcast (RSS Feed😞

CheckMates in Your Language!

While most of the content on CheckMates is in English, we now have a few groups where both content and discussions are available in other languages! 

• CheckMates in Russian - ЧекМейтс по-русски
• CheckMates en Français
• CheckMates Taiwan論壇

CheckMates in Belgium and Ireland

Valeri Loukine‌ and I did the last CheckMates events for 2018 in Belgium and Ireland. A great time was had by all.

"I'm not ready yet, guys!"

He won the Kahoot!

CheckMates will be at all three CPX 360 2019 event in January and February. See you there?

Community Highlights

Here are the conversations worth watching in the community:

BEYOND - Customer Success Hub 

We launched our new online portal for TAC cases! Check the thread for more details and share your feedback.

Two ISP's with two appliances 4800 R80.10 

And related thread: CheckPoint Cluster Failover Query. Bottom line: Both ISPs need to be available/reachable from both gateways.

Deploying E80.88 Packages with MDT Build 8450 

Nice video showing how to deploy the Endpoint solution.

id, ID and OE inspection points in R80.20 GA? 

If you're using fw monitor in R80.20, you'll see some different "inspection points." This thread explains.

R80.20 SecureXL drop template support 

Yes, they're still supported even though one doc suggested they weren't.

Finding Mobile Access concurrent user license level 

We made this much easier in R80.x.

Missing header X-chkp-sid in login? 

Make sure you're calling the correct API endpoint.

How can we block Nmap and other Port scanners 

SmartEvent, anyone?

Why does the wrong flag show up for an IP address in GeoBlocking? 

Never seen that myself, but makes sense that it could.

Installation & Upgrade problems from R77.x to R80.x 

A collection of upgrades that went successfully...and not.

Prevent low confidence Anti bot protection 

Update the Threat Prevention profile to block it.

Upcoming Events

• 9th January 2019: New Years Toast and Migrate to R80.20 
• 5th March 2019: Check Point R80.20 Updates, Troubleshooting and Support Best Practices, Live in Bratislava!

And, of course, CPX 360 2019!

Video Link : 10813

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!

Past and future posts will be available here: About CheckMates

To have these updates show up in your preferred RSS reader add the following URL: About CheckMates RSS Feed 

See also our social media accounts and our podcast (RSS Feed😞

CheckMates in Your Language!

While most of the content on CheckMates is in English, we now have a few groups where both content and discussions are available in other languages! 

• CheckMates in Russian - ЧекМейтс по-русски
• CheckMates en Français
• CheckMates Taiwan論壇

CheckMates in the UK and Nashville

Valeri Loukine‌ did some internal evangelizing of CheckMates with our UK colleagues:

Meanwhile I did the last US-based event for the year in Nashville:

Next week, Val and I are teaming up to do the last CheckMates events for 2018 in Europe. 

Community Highlights

Here are the conversations worth watching in the community:

R80.20 Security Gateway with new Gaia based on kernel 3.10 is GA for CloudGuard and HP Gen10 ! 

Not fully supported on Check Point appliances yet, but it's coming. And very soon: on Scalable Platforms (44k/64k)!

https://community.checkpoint.com/people/a1f28a75-6e6d-4a5a-bff0-ccb164d07a86/blog/2018/12/06/r8020-m... 

Likewise, you can install R80.20 Management in AWS. Gateway? It's coming very soon.

https://community.checkpoint.com/community/infinity-general/appliances-and-gaia/blog/2018/12/06/new-... 

Doesn't even require you to upgrade to R80.20

HPS Emulation 

Another name for CPU-Level Threat Prevention.

NAT Templates - SecureXL 

Why they weren't enabled by default until R80.20.

The flow time of the logs seems different

Session consolidation is the likely culprit.

R80.10 Smart Console - how to view NAT properties for objects within a group 

Where to find the Object Explorer in R80.x.

DNS Trap 

How does it work?

How are security professionals influenced by analysts ? 

A little market research.

https://community.checkpoint.com/thread/10614-anti-virus-not-blocking-malicious-zip-doc-files 

Setting Resource Classification to Background mode can cause this.

Upcoming Events

• 11th December 2018: Check Point R80.20 Updates, Troubleshooting and Support Best Practices, Live in Zaventem 
• 13th December 2018: CheckMates Live! in Dublin!
• 9th January 2019: New Years Toast and Migrate to R80.20 
• 5th March 2019: Check Point R80.20 Updates, Troubleshooting and Support Best Practices, Live in Bratislava!‌

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!

Past and future posts will be available here: About CheckMates

To have these updates show up in your preferred RSS reader add the following URL: About CheckMates RSS Feed 

See also our social media accounts and our podcast (RSS Feed😞

CheckMates in Your Language!

While most of the content on CheckMates is in English, we now have a few groups where both content and discussions are available in other languages! 

• CheckMates in Russian - ЧекМейтс по-русски
• CheckMates en Français
• CheckMates Taiwan論壇

CheckMates at Home

It's been a while since both Valeri Loukine‌ and I were not on the road somewhere. 

Valeri took some well-deserved time off, I stuck around the homestead.

No pictures to share.

Ok, maybe one:

Community Highlights

Here are the conversations worth watching in the community:

TechTalk: Dome9 Overview and Q&A 

If you missed our TechTalk on Dome9 and you're using Azure, AWS, or Google Cloud (or even thinking about it), watch the recording of this TechTalk!

R80.20.M1 SmartConsole coexisting with R80.20 

Portable SmartConsole to the rescue!

R80.20 - Portable SmartConsole + Tips and Tricks 

Speaking of portable SmartConsole...

Open Server to Appliance 

All the cool kids are moving the Check Point appliances from Open Server

Add new cores to gateway 

Speaking of Open Servers, if you add more licensed cores, this thread will be helpful.

ClusterXL maintenance 

Not cluster maintenance necessarily, but maintenance on the hardware around the cluster...

False Positive on logs (Sandblast Agent) on BANKING Sites 

Looks like a bug we fixed in an upcoming release.

New Tool: CPPCAP 

A new and improved "tcpdump" for Gaia OS.

No logging in Logging and Monitor tab 

If you have your management and log server separated, this thread is relevant.

New Appliance Sizing Tool. Do you like it? 

This thread is really only relevant to Partners who have access to the tool, which was recently updated.

Upcoming Events

• 6th December 2018: Migrate to R80.20, Live in Nashville!
• 11th December 2018: Check Point R80.20 Updates, Troubleshooting and Support Best Practices, Live in Zaventem 
• 13th December 2018: CheckMates Live! in Dublin!
• 9nd January 2019: New Years Toast and Migrate to R80.20 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!

Past and future posts will be available here: About CheckMates

To have these updates show up in your preferred RSS reader add the following URL: About CheckMates RSS Feed 

See also our social media accounts and our podcast (RSS Feed😞

CheckMates in Your Language!

While most of the content on CheckMates is in English, we now have a few groups where both content and discussions are available in other languages! 

• CheckMates in Russian - ЧекМейтс по-русски
• CheckMates en Français
• CheckMates Taiwan論壇

CheckMates in Frankfurt and Athens

It was Thanksgiving this past week in the US, so I took a break from the shiny metal tubes and CheckMates events.

Meanwhile, Valeri Loukine‌ packed them in at Frankfurt and Athens:

Amit Sharon‌ and Niran Turgeman‌ also joined Valeri Loukine‌ in Athens!

Community Highlights

Meanwhile, here are the conversations worth watching in the community:

Call For Papers CPX 360 2019 

Last week to submit for our CFP for CPX 360! Got something to tell the Check Point community live and on-stage? We'd love to hear from you!

How do I add SecureGateway to Cisco ISE 2.4 using RADIUS? 

A solution eventually came

SmartConsole Scripts Repository usecases and experience 

Related thread: Proper place to put custom scripts 

Access layer policies 

How ordered layers work

R80.x Performance Tuning Tip – Multi Queue 

Sometimes you need to bring in the heavy guns. See also: Open Server - HCL for multi queue network cards 

R80.20/R80.10 MTA now includes AV blade features 

Update your MTA in CPUSE to get the benefits!

Extract a policy from 77.30 and move it to 80.10 

I think we cover all the possible ways here

Sandblast and .msg attachments  

Yes, they're supported.

FQDN and Domain Objects in R80.10 when DNS server fail? 

Good things to know and tables to review when troubleshoot.

https://community.checkpoint.com/docs/DOC-3362 

Just like it says

Upcoming Events

• 28th November 2018: TechTalk: Dome9 Overview 
• 29th November 2018: Migrate to R80.20, Live in Bellevue, WA!
• 6th December 2018: Migrate to R80.20, Live in Nashville!
• 11th December 2018: Check Point R80.20 Updates, Troubleshooting and Support Best Practices, Live in Zaventem 
• 13th December 2018: CheckMates Live! in Dublin!
• 2nd January 2019: New Years Toast and Migrate to R80.20 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!

Past and future posts will be available here: About CheckMates

To have these updates show up in your preferred RSS reader add the following URL: About CheckMates RSS Feed 

See also our social media accounts and our podcast (RSS Feed😞

CheckMates in Your Language!

While most of the content on CheckMates is in English, we now have a few groups where both content and discussions are available in other languages! 

• CheckMates in Russian - ЧекМейтс по-русски
• CheckMates en Français
• CheckMates Taiwan論壇

CheckMates in Florida and Prague

The problem with being a one-man show sometimes is you don't always get pictures.

In case you need proof I was in Florida, though:

Meanwhile, Valeri Loukine‌ had a good crowd in Prague:

Community Highlights

Meanwhile, here are the conversations worth watching in the community:

Call For Papers CPX 360 2019 

We've extended our CFP deadline to 30th November. Got something to tell the Check Point community live and on-stage? We'd love to hear from you!

*New* Splunk App for Check Point Logs 

Announcing our new integration with Splunk that leverages Log Exporter.

Mac OSX 10.14 Beta (Mojave) 

There's an EA available for this now that you can sign up and be a part of!

If you are tired typing netstat -nr | grep ^x.x.x.x 

Many ways to get the same information.

Kernel global parameters - the most useful settings 

What kernel parameters do you tweak?

Nested layers 

Something we don't currently support, but you can sort of emulate with the existing layers.

Data Center Objects not updating - force refresh? 

How to debug this issue.

Traffic is originating from a VS with the VSX internal communication address 

Not something you want to see.

R80.20.M1 to R80.20 Upgrade 

The procedure has been released but we are also still rolling out the code. 

Management HA: Member in Collision Status 

Always good to make sure your management servers are running the same jumbo hotfix.

CheckMates in Your Language!

While most of the content on CheckMates is in English, we now have a few groups where both content and discussions are available in other languages! 

• CheckMates in Russian - ЧекМейтс по-русски
• CheckMates en Français
• CheckMates Taiwan論壇

CheckMates in Kiev and Jacksonville

This week, Valeri Loukine‌ was in Kiev doing our first event. 

Have to say, I'm jealous: it looks like a nice facility!

Meanwhile, I was in Jacksonville, Florida with Adam Forester‌ talking about the API:

Community Highlights

Meanwhile, here are the conversations worth watching in the community:

https://community.checkpoint.com/community/about-checkmates/blog/2018/09/12/call-for-papers-cpx-360-... 

CPX 360 is coming up. Got something to speak about? We'd love to have you!

Invitation to join a new EA program for HTTP/2 inspection 

Need to inspect the next generation of HTTP? This would be a great Early Availability program to be a part of!

Gateway behind NAT. What limitations am I to be aware of? 

My guess is this is more common of a configuration than we think.

HTTP Daemon (Multiportal) on HA Standby device (R80.10 build 421) 

If you're not able to get to HTTPS on the standby device, this is a quick thing to check.

Bypassing IPS Protections - MySQL 

There's a couple ways to exclude certain protections from inspection on certain hosts.

Disable "Local interface address spoofing" 

This comes up when you run a Security Gateway with a mirror port.

A neat idea, but we've got a few of these already (and they're linked here).

Migrating policies from standalone gateway to new management server 

Hopefully we'll have a better solution for this problem in the near future. In the meantime, there's this.

Hide NAT issues with virtual addresses 

Don't forget Layer 2 when you NAT.

R80.20 Managing R80.10 Gateway - CPU Increase 

Curious issue where we did find a bug with SecureXL licensing on Open Servers.

https://community.checkpoint.com/docs/DOC-3321-r80x-performance-tuning-tip-smt-hyper-threading 

This applies to R77.x as well on Check Point appliances.

Upcoming Events

Between Valeri Loukine and I, we'll be busy in the next several weeks!

Also, note the upcoming Techtal

• 13th November 2018: Migrate to R80.20, Live in Prague!
• 13th November 2018: Migrate to R80.20, Live in Miami!
• 14th November 2018: Migrate to R80.20, Live in Ft. Lauderdale!
• 20th November 2018: Migrate to R80.20 Live in Frankfurt! 
• 22nd November 2018: Migrate to R80.20 Live in Athens! 
• 28th November 2018: TechTalk: Dome9 Overview 
• 29th November 2018: Migrate to R80.20, Live in Bellevue, WA!
• 6th December 2018: Migrate to R80.20, Live in Nashville!‌
• 11th December 2018: Check Point R80.20 Updates, Troubleshooting and Support Best Practices, Live in Zaventem 
• 13th December 2018: CheckMates Live! in Dublin!
• 2nd January 2019: New Years Toast and Migrate to R80.20 

Welcome to "This Week in CheckMates," your weekly highlight reel for all things CheckMates!

Past and future posts will be available here: About CheckMates

To have these updates show up in your preferred RSS reader add the following URL: About CheckMates RSS Feed 

See also our social media accounts and our podcast (RSS Feed😞

CheckMates in Your Language!

While most of the content on CheckMates is in English, we now have a few groups where both content and discussions are available in other languages! 

• CheckMates in Russian - ЧекМейтс по-русски
• CheckMates en Français
• CheckMates Taiwan論壇

CheckMates in Denmark

Valeri Loukine‌ and I joined forces this week to do two events in Denmark: Hellerup (near Copenhagen) and Skanderborg!

(Oh yeah, and FlatMoti too!)

Thank you Inga Nielsen‌ and Niels Poulsen‌ for hosting us!

Community Highlights

Meanwhile, here are the conversations worth watching in the community:

RulebaseExporter/RulebaseImporter 

Uses the API and JQ to process the output. A bit faster than just using the API to do it.

Upgrade from R77.30 to R80.10 via CPUSE 

I do this live all the time in User Group meetings, but it's nice to see a video of the process as well. 

Pretty sure I know what the community thinks about this

Firewall rule from remote users to site-to-site network 

Chaining VPNs together.

Gil Shwed & Zohar Alon (Dome9) Ask me Anything 

Hopefully we'll have a TechTalk on Dome9 very soon. Meanwhile, we have a short "ask me anything" video.

Another SmartConsole Usability Issue 

We want to hear all the feedback (good and bad) on CheckMates.

How to migrate Full HA Cluster(r77.30 to r80.10)? 

Assuming your hardware is strong enough to run R80.10 Gateway and Management, here's how.

Is there a way to share View created by one user with other users? 

News on this front.

How to migrate from standalone configuration (R80.10) to distributed? 

While we don't have "official" support for this currently, someone worked out how to make it work

https://community.checkpoint.com/thread/10115-r7730-sessions-vs-r8010-logs-ips-events 

Some differences in how logs are correlated between the two versions.

Upcoming Events

Between Valeri Loukine and I, we'll be busy in the next several weeks!

• 6 November 2018: Check Point CheckMates API Training Class
• 8 November 2018:  Migrate to R80.20 Live in Kiev!‌
• 13th November 2018: Migrate to R80.20, Live in Prague!
• 13th November 2018: Migrate to R80.20, Live in Miami!
• 14th November 2018: Migrate to R80.20, Live in Ft. Lauderdale!
• 20th November 2018: Migrate to R80.20 Live in Frankfurt! 
• 22nd November 2018: Migrate to R80.20 Live in Athens! 
• 29th November 2018: Migrate to R80.20, Live in Bellevue, WA!‌
• 11th December 2018: Check Point R80.20 Updates, Troubleshooting and Support Best Practices, Live in Zaventem 
• 13th December 2018: CheckMates Live! in Dublin!‌