sam_alert -f

[Luis_Miguel_Mig]

by default sam_alert install in all the firewalls.
How could I exclude same firewall or clusters?
Or how could I include only specific firewalls or clusters? What is the syntax to install it in a list of fw/clusters?

https://support.checkpoint.com/results/sk/sk110873

would something like this work?

sam_alert -f gw1, gw2

sam_alert -f cluster1, cluster2

[Amir_Senn]

From what I know, syntax doesn't support 2 targets. You need to run it multiple times if you want different GWs to have it.

You can also do "dry runs" and look at "SmartView Monitor" to see the policy:

[the_rock]

It works, but only 1 gw is possible in the command.

Andy

[Luis_Miguel_Mig]

so If I can't configure multiple targets, could I disable SAM in certain gateways? So when I run the default install in all, it only gets installed in the gateways I want. How?

[the_rock]

You mean disable ability to create sam rule on specific gateway?

[Luis_Miguel_Mig]

yes

[the_rock]

That Im not sure, sorry. Maybe @Amir_Senn can confirm.

Andy

[Amir_Senn]

I will need to look at documentation and experiment in my lab to provide an answer to that. Will try to get to it when I can.

WA I suggest is using script with desired GWs in a list and instead of using regular commands and let the script go over it.

[Luis_Miguel_Mig]

would something like this at  <global properties - log and alert - alerts - run userdefined script> work?

sam_alert -t 600 -I -src -f cluster1; sam_alert -t 600 -I -src -f cluster2

[the_rock]

Interesting idea...let me see if I can test it in the lab.

[Luis_Miguel_Mig]

I have tested it and it doesn't work.
Now in terms of the script, I have read recommendation to run the script on path $FWDIR/bin. The problem with that path is that we will need to copy the script the new $FWDIR/bin everytime we do an upgrade, right? Is there any other path that will survive an upgrade?

I also have the impression that sam_alert reads a line of stdin and then goes to the next, so it is not possible to run to sam_alert with the same ip address to block and two different clusters.

$FWDIR/bin

script.sh
#!/bin/bash
sam_alert -t 600 -I -src -f cluster1
sam_alert -t 600 -I -src -f cluster2

chmod 755 script.sh

[the_rock]

For sure, script would need to be copied, as its not built in.