Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
davidso
Explorer
Jump to solution

Export Firewall configuration

Hi Mates,

I am using 2 x CheckPoint 5600 Firewall in my workplace.
We are requested by our Internal Audit that we need to export and review the Firewall configuration periodically.
I am the only person here who hold the Firewall Administrator password, and I am not allow to share out the admin pwd.

Can anyone guide me on how to create a READ ONLY account that can export the FireWall Configuration file?

thank you very much.
---david

0 Kudos
1 Solution

Accepted Solutions
_Val_
Admin
Admin

Incorrect. You already have built-in monitor user in Gaia. Alternatively, create a new and assign monitorOnly role to it.

This user (you will have to reset its password) is allowed to SSH, CLISH only. It can run "show..." commands. In this context, "show configuration" is what you are looking for.

It will not "export" config out, but will allow auditors to see output of config as part of the ssh session. They can log the session and use the data. 

You do not want to give read-only users access to expert. If you are looking for a capability to send a file out, that is exactly the issue. Expert mode trumps all CLISH restrictions.

View solution in original post

0 Kudos
8 Replies
_Val_
Admin
Admin

What kind of export? MGMT database? OS settings? Please elaborate

0 Kudos
davidso
Explorer

Only the OS settings.  thank you.

0 Kudos
_Val_
Admin
Admin

You need to set up a new OS account and assign it to monitorOnly role

Read the Gaia admin guide for more details.https://sc1.checkpoint.com/documents/R80.40/WebAdminGuides/EN/CP_R80.40_Gaia_AdminGuide/Content/Topi...

0 Kudos
davidso
Explorer

Hi _Val_, The two READ ONLY accounts that i mentioned were exactly in the MonitorRole.  But they seem do not have the privilege to export the configuration nor ssh-in.  thanks. --david 

0 Kudos
_Val_
Admin
Admin

Incorrect. You already have built-in monitor user in Gaia. Alternatively, create a new and assign monitorOnly role to it.

This user (you will have to reset its password) is allowed to SSH, CLISH only. It can run "show..." commands. In this context, "show configuration" is what you are looking for.

It will not "export" config out, but will allow auditors to see output of config as part of the ssh session. They can log the session and use the data. 

You do not want to give read-only users access to expert. If you are looking for a capability to send a file out, that is exactly the issue. Expert mode trumps all CLISH restrictions.

0 Kudos
davidso
Explorer

thank you!

0 Kudos
_Val_
Admin
Admin

you are welcome

0 Kudos
davidso
Explorer

according to some experts they mention something adding a RULE to allow these READ ONLY accounts to access SSH and the WEB interface that can serve the same purpose.  Can you please guide me through how to set this rule(s)?  Many Many thanks. --david

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events