Advanced Checkpoint Gaia CLI Commands (Tips and Tricks)

With my most populous post “Basic Checkpoint Gaia CLI Commands (Tips and Tricks)“, I would like to
collect some more advanced troubleshooting commands used in my daily work into this post. Actually, some of commands are not only for Checkpoint Gaia, it will be for SPLAT or IPSO platform as well. This post will keep updating as soon as I have something new.

1. fw ctl chain

Check Checkpoint Security Gateway packet inspection order/chain. For more details, check the post “How Firewalls (Security Gateways) Handle the Packets?“

in chain (18):
        0: -7f800000 (f28854f0) (ffffffff) IP Options Strip (in) (ipopt_strip)
        1: -7d000000 (f1796f10) (00000003) vpn multik forward in
        2: – 2000000 (f177cb70) (00000003) vpn decrypt (vpn)
        3: – 1fffff8 (f1787c00) (00000001) l2tp inbound (l2tp)
        4: – 1fffff6 (f2886ca0) (00000001) Stateless verifications (in) (asm)
        5: – 1fffff5 (f28bce30) (00000001) fw multik misc proto forwarding
        6: – 1fffff2 (f17a4df0) (00000003) vpn tagging inbound (tagging)
        7: – 1fffff0 (f177a150) (00000003) vpn decrypt verify (vpn_ver)
        8: – 1000000 (f29049c0) (00000003) SecureXL conn sync (secxl_sync)
        9:         0 (f282f810) (00000001) fw VM inbound  (fw)
        10:         1 (f28a6b30) (00000002) wire VM inbound  (wire_vm)
        11:   2000000 (f177b5e0) (00000003) vpn policy inbound (vpn_pol)
        12:  10000000 (f2902cb0) (00000003) SecureXL inbound (secxl)
        13:  7f600000 (f287ab70) (00000001) fw SCV inbound (scv)
        14:  7f730000 (f2a13500) (00000001) passive streaming (in) (pass_str)
        15:  7f750000 (f2c0bef0) (00000001) TCP streaming (in) (cpas)
        16:  7f800000 (f2885890) (ffffffff) IP Options Restore (in) (ipopt_res)
        17:  7fb00000 (f2fac050) (00000001) HA Forwarding (ha_for)
out chain (15):
        0: -7f800000 (f28854f0) (ffffffff) IP Options Strip (out) (ipopt_strip)
        1: -78000000 (f1796ef0) (00000003) vpn multik forward out
        2: – 1ffffff (f1779a10) (00000003) vpn nat outbound (vpn_nat)
        3: – 1fffff0 (f2c0bd70) (00000001) TCP streaming (out) (cpas)
        4: – 1ffff50 (f2a13500) (00000001) passive streaming (out) (pass_str)
        5: – 1ff0000 (f17a4df0) (00000003) vpn tagging outbound (tagging)
        6: – 1f00000 (f2886ca0) (00000001) Stateless verifications (out) (asm)
        7:         0 (f282f810) (00000001) fw VM outbound (fw)
        8:         1 (f28a6b30) (00000002) wire VM outbound  (wire_vm)
        9:   2000000 (f1779c30) (00000003) vpn policy outbound (vpn_pol)
        10:  10000000 (f2902cb0) (00000003) SecureXL outbound (secxl)
        11:  1ffffff0 (f17887b0) (00000001) l2tp outbound (l2tp)
        12:  20000000 (f177d5b0) (00000003) vpn encrypt (vpn)
        13:  7f700000 (f2c0e340) (00000001) TCP streaming post VM (cpas)
        14:  7f800000 (f2885890) (ffffffff) IP Options Restore (out) (ipopt_res)

2. Proxy Arp

a. Use the Gaia portal.
Network Management -> Arp -> Proxy ARP

b. Use the command line (in Gaia):
add arp proxy ipv4-address 172.16.0.8 interface eth0 real-ipv4-address 172.16.0.22

Actually the GAIA command above convert it automatically to a file called local.arp

c. Use the command line (in expert mode):
Then insert the information directly to /opt/CPsuite-R76/fw1/conf/local.arp
echo “172.16.0.8 00:0c:29:f1:b7:74 172.16.0.22” >> $FWDIR/conf/local.arp


Verify the changes after a policy push with command “fw ctl arp”:

3. fw ctl zdebug drop

lists all dropped packets in real time gives an explanation why the packet is dropped

4. TCPDUMP

• tcpdump port 257   , <– on the firewall, this will allow you to see if the logs are passing from the firewall to the manager, and what address they are heading to.
• tcpdump -i WAN.15  <- to capture everything on this interface
• tcpdump -i eth1.16 icmp  <– to capture just PINGs on this interface
• tcpdump -i  Mgmt -vvv -s0 -w tcpdumpfile.log   <– this captures the FULL packets to a file usefull for wireshark the -s0 stops the files being shortened
• tcpdump -i INT port 67   <– view dhcp requests
• tcpdump -eP -nni any host 10.9.4.30 <-disable both name and service port resolution while performing a capture, by using the -nn option; -e Print the link-level header on each dump line. This can be used, for example, to print MAC layer addresses for protocols such as Ethernet and IEEE 802.11. -p–no-promiscuous-mode.
• tcpdump -i any  <- any can be used to tell tcpdump to listen on all interfaces
• tcpdump -n  <- disable to lookup and translate hostnames and ports.

Reference: Understanding TCPDUMP Output

5. FW Monitor

• fw monitor -e ‘accept host(192.168.1.12);’   <– Show packets with IP 192.168.1.12 as SRC or DST
• fw monitor -e ‘accept src=192.168.1.12 and dst=192.168.3.3;’ <–Show all packets from 192.168.1.12 to 192.168.3.3
• fw monitor -pi ipopt_strip -e ‘accept udpport(53);’ <–Show UDP port 53 (DNS) packets, pre-in position is before ‘ippot_strip’
• fw monitor -m O -e ‘accept udp and (sport>1023 or dport>1023);’ <– Show UPD traffic from or to unprivileged ports, only show post-out
• fw monitor -e ‘accept net(192.168.1.0,24) and tracert;’ <–Show Windows traceroute (ICMP, TTL<30) from and to network 192.168.1.0/24
• fw monitor -v 23 -e ‘accept tcpport(80);’ <–Show Capture web traffic for VSX virtual system ID 23
• fw monitor -e ‘accept ip_p=50 and ifid=0;’ <–Show all ESP (IP protocol 50) packets on the interface with the ID 0. (List interfaces and corresponding IDs with fw ctl iflist)
• srfw monitor -o output_file.cap <–Show traffic on a SecuRemote/SecureClient client into a file. srfw.exe is in $SRDIR/bin (C:Program FilesCheckPointSecuRemotebin)

6. VPN tu

vpn tu  or  vpn tunnelutil

********** Select Option **********

(Q)  Quit 



7. Disk/File/Folder Commands

Checkpoint SK60080 displays some solutions to resolve excessive disk consumption on SPLAT/Gaia/IPSO/Lunix OS system. Here are some helpful commands:
a. df -h  (view the partition table and its associated utilization)
b. du -h –max-depth=1 /opt | sort -n -r   (examine disk space utilization at directory-level)
c. ls -1 $FWDIR/conf/db_versions/repository/ | wc -l   (check the number of database revisions on a Security Management server)
d. ls -l $RTDIR/distrib/* | wc -l  (counts the number of records)
e. evstop & evstart (Stop / start the Eventia / SmartEvent)
f. rm -r $RTDIR/distrib/* (Purge this directory of stale records)

8. Connections

CP-1> fw tab -t connections -s
HOST                  NAME                               ID #VALS #PEAK #SLINKS
localhost             connections                      8158    77   948     179

Note: 
The NAME Id is the actual table number. 
The VALS colum is the current number of connections that are in the connections table at the time the command was run. 
The PEAK number is the max number of connections that have been recorded since the last reboot. 
The SLINKS table is a table of symbolic link that point to the real connection entry. There are usually 4 symbolic links per connection. This way no matter which direction the packet comes, there will be an entry for it. There is more to it than that, but that is the general idea.

CP-1> fw ctl pstat

System Capacity Summary:
  Memory used: 8% (62 MB out of 696 MB) – below watermark
  Concurrent Connections: 0% (79 out of 24900) – below watermark
  Aggressive Aging is in detect mode

Hash kernel memory (hmem) statistics:
  Total memory allocated: 71303168 bytes in 17408 (4096 bytes) blocks using 1 pool
  Total memory bytes  used:  9703728   unused: 61599440 (86.39%)   peak: 18891512
  Total memory blocks used:     2665   unused:    14743 (84%)   peak:     4705
  Allocations: 198489371 alloc, 0 failed alloc, 198382561 free

System kernel memory (smem) statistics:
  Total memory  bytes  used: 117769900   peak: 120093268
  Total memory bytes wasted:   996590
    Blocking  memory  bytes   used:  2530356   peak:  2557584
    Non-Blocking memory bytes used: 115239544   peak: 117535684
  Allocations: 433810 alloc, 28 failed alloc, 432937 free, 0 failed free
  vmalloc bytes  used: 114086588 expensive: no

Kernel memory (kmem) statistics:
  Total memory  bytes  used: 56103032   peak: 66020104
  Allocations: 198922588 alloc, 28 failed alloc
               198815489 free, 0 failed free
  External Allocations: 0 for packets, 0 for SXL

Cookies:
        90753187 total, 0 alloc, 0 free,
        7839 dup, 2107678 get, 160176 put,
        91154457 len, 0 cached len, 0 chain alloc,
        0 chain free

Connections:
        231169 total, 7807 TCP, 4665 UDP, 182351 ICMP,
        36346 other, 0 anticipated, 3 recovered, 79 concurrent,
        948 peak concurrent

Fragments:
        0 fragments, 0 packets, 0 expired, 0 short,
        0 large, 0 duplicates, 0 failures

NAT:
        80509/0 forw, 5266/0 bckw, 85750 tcpudp,
        16 icmp, 10440-949656 alloc

Sync:
        Version: new
        Status: Able to Send/Receive sync packets
        Sync packets sent:
         total : 864451,  retransmitted : 0, retrans reqs : 15,  acks : 1826
        Sync packets received:
         total : 3614413,  were queued : 30, dropped by net : 15
         retrans reqs : 0, received 11745 acks
         retrans reqs for illegal seq : 0
         dropped updates as a result of sync overload: 0
        Callback statistics: handled 11588 cb, average delay : 1,  max delay : 5

9. Check Point SecureXL

To enable SecureXL, run the command:
CP[admin]# fwaccel on

To disable SecureXL, run the command:
CP[admin]# fwaccel off

Note: The fwaccel off command is not persistent and SecureXL will be enabled again after a reboot of the system. SecureXL can be permanently disabled through the CPconfig utility.

To check the number of accelerated connection and other SecureXL statistics: CP[admin]# netstat -f
To check the number of accelerated SA (VPN traffic): CP[admin]# netstat -s
To check overall SecureXL statistics:  CP[admin]# fwaccel stat

14. Installation of Hotfixes on Gaia or SPLAT

1. sk97638 – Check Point Processes and Daemons
2. sk98348 – Best Practices – Security Gateway Performance

Reference:

1. Check Point/SPLAT/Network Debug Cheat Sheet
2. A tcpdump Primer with Examples
3. Check Point fw monitor cheat sheet – 20141028
4. Check Point CLI Reference Card – 20150617 by Jens Roesen
5. Upgrading ClusterXL Deployments(R77)