Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
HeikoAnkenbrand
Champion Champion
Champion

R80.20 - new interesting commands

I've been testing R80.20 very intensively in the lab over the last few days. Here I have discovered some interesting new commands on CLI. What did you discover that didn't exist before?

# cphaprob stat     > with more clusterxl informations

# fwaccel ranges   > show's anti spoofing ranges

# fw ctl multik utilize   > shows the CoreXL queue utilization for each CoreXL FW instance

# fw ctl multik print_heavy_conn   > shows the table with heavy connections

 

More see:

Command Line Interface R80.20 Reference Guide 

 

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
41 Replies
HeikoAnkenbrand
Champion Champion
Champion

See more: R80.20 - more ClusterXL state informations

# cphaprob stat

Regards,

Heiko

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
HeikoAnkenbrand
Champion Champion
Champion

Exciting command show's anti spoofing ranges:-)

You have to take a closer look.

# fwaccel ranges

Regards,

Heiko

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
HeikoAnkenbrand
Champion Champion
Champion

Shows the CoreXL queue utilization for each CoreXL FW instance

# fw ctl multik utilize

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
Yoni-Indeni
Participant

Have you ever seen the queue fill up? Is this something worth tracking and adding a script to Indeni for?

CEO & Founder, Indeni
HeikoAnkenbrand
Champion Champion
Champion

Shows the table with Heavy Connections (that consume the most CPU resources) in the CoreXL
Dynamic Dispatcher.
# fw ctl multik print_heavy_conn
➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
Ofir_Shikolski
Employee Alumnus
Employee Alumnus

fw ctl multik stop / start 

HeikoAnkenbrand
Champion Champion
Champion

nice info

thx,

heiko

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
0 Kudos
HeikoAnkenbrand
Champion Champion
Champion

More  see  here:

https://community.checkpoint.com/thread/11958-enable-and-disable-corexl-instances-on-the-fly 

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
0 Kudos
HeikoAnkenbrand
Champion Champion
Champion

The blacklist blocks all traffic to and from the specified IP addresses.

The blacklist drops occur in SecureXL, which is more efficient than an Access Control Policy to drop the packets.

This can be very helpful e.g. with DoS attacks to block an IP on SecureXL level.

# fwaccel dos blacklist -a <ip>

# fwaccel dos blacklist -s

# fwaccel dos blacklist -d <ip>

More see here:

R80.20 - IP blacklist in SecureXL 

Regards,

Heiko

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
Jelle_Hazenberg
Collaborator
Collaborator

This looks a lot like #sim dropcfg which has the same functionality.

edit:

Off course its handy to have a link to more information of this useful feature

See Accelerated Drops which is supported since 75.40

HeikoAnkenbrand
Champion Champion
Champion

nice info

 

thx,

heiko

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
0 Kudos
HeikoAnkenbrand
Champion Champion
Champion

# fw ctl chain

The new fw monitor chain modules (SecureXL) do not run in the virtual machine (vm):

SecureXL inbound (sxl_in)                    > Packet received in SecureXL from network

SecureXL inbound CT (sxl_ct)              > Accelerated packets moved from inbound to outbound processing (post routing)

SecureXL outbound (sxl_out)               > Accelerated packet starts outbound processing

SecureXL deliver (sxl_deliver)             > SecureXL transmits accelerated packet

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
HeikoAnkenbrand
Champion Champion
Champion

There are more new chain modules in R80.20:

vpn before offload (vpn_in)                  > FW inbound preparing the tunnel for offloading the packet (along with the connection)

fw offload inbound (offload_in)            > FW inbound that perform the offload

fw post VM inbound  (post_vm)            > Packet was not offloaded (slow path) - continue processing in FW inbound

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
HeikoAnkenbrand
Champion Champion
Champion

More see here:

R80.20 SecureXL + new chain modules + fw monitor 

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
0 Kudos
HeikoAnkenbrand
Champion Champion
Champion

In firewall kernel (now also SecureXL), each kernel is associated with a key (blue) witch specifies the type of traffic applicable to the chain modul.

 

# fw ctl chain

# fw monitor -e ...

 

KeyFunction
ffffffffIP Option Stip/Restore
00000001new processed flows
00000002wire mode
00000003will applied to all ciphered traffic (VPN)
00000000SecureXL offloading (new in R80.20+)
➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
HeikoAnkenbrand
Champion Champion
Champion

More see here:

R80.20 SecureXL + new chain modules + fw monitor 

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
0 Kudos
HeikoAnkenbrand
Champion Champion
Champion

New ClusterXL clish commands:

> show cluster

> show cluster mmagic

More see here:

R80.20 - new ClusterXL commands 

Regards,

Heiko

.

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
HeikoAnkenbrand
Champion Champion
Champion

> show cluster stats

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
0 Kudos
HeikoAnkenbrand
Champion Champion
Champion

> show cluster failover

 

Reset history:

> show cluster failover reset history

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
HeikoAnkenbrand
Champion Champion
Champion

> show cluster roles

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
0 Kudos
HeikoAnkenbrand
Champion Champion
Champion

> show cluster statistics transport

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
0 Kudos
HeikoAnkenbrand
Champion Champion
Champion

> show cluster statistics sync

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
HeikoAnkenbrand
Champion Champion
Champion

> show cluster members interfaces all

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
0 Kudos
HeikoAnkenbrand
Champion Champion
Champion

> show cluster members pnotes all

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
0 Kudos
Sandro_Gerdel
Participant

Nice new commands.

Cheers,

Sandro

HeikoAnkenbrand
Champion Champion
Champion

Fetches and unloads Threat Prevention policy.

Threat Prevention policy applies to these Software Blades:

  • Anti-Bot
  • Anti-Virus
  • Anti-Spam
  • Threat Emulation
  • Threat Extraction
  • IPS

# fw amw unload                    -> To unload the current Threat Prevention policy.

# fw amw fetch localhost      -> To fetch the Threat Prevention policy stored locally on the Security Gateway.

More see:

Command Line Interface R80.20 Reference Guide 

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
_Val_
Admin
Admin

it would help to put a link to CLI reference guide in the original post

HeikoAnkenbrand
Champion Champion
Champion

"iotop" watches I/O usage information output by the Linux kernel  and displays a table of current I/O usage by processes or threads on the system. Only available on gateway with R80.20 3.10 kernel (see Check Point R80.20 with Gaia 3.10 for Security Gateways).

# iotop -b -n 1

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
Patricia_OSulli
Participant

great job

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events