delete SA and IKE priodly

[stephan411]

Hallo,

it is possible that I can delete SA and IKE priodly such as by a cron job or by a script. I know that I mus use vpn tu to delete SA and IKE. But how can I work with the parameters 1 to 8?

Thank you,
Stephan

[kva.kva]

https://secureknowledge.checkpoint.c....do?id=skI2004

If you want it, you can use fw tab -t table_name -x
table_name:
To delete IKE SAs, delete the IKE_SA_table.
To delete IPSEC SAs, delete the inbound_SPI table and the outbound_SPI table.

If you want cron script, use next syntax in it:
#!/bin/bash
fw tab -t IKE_SA_table -x <<EOC
yes
EOC

[stephan411]

Thank you for your answer.

What does EOC means? And what does especialy >> EOC means?

Stephan

[kva.kva]

EOC is a mark. << is "here document"

From Advanced Bash−Scripting Guide (very useful doc - http://tldp.org/LDP/abs/html/)

A "here document" is a special−purpose code block. It uses a form of I/O redirection to feed a command list to an interactive program or a command, such as ftp, cat, or the ex text editor.

COMMAND <<InputComesFromHERE
...
InputComesFromHERE

A limit string delineates (frames) the command list. The special symbol << designates the limit string. This has the effect of redirecting the output of a file into the stdin of the program or command. It is similar to

interactive-program < command−file, where command−file contains
command #1
command #2
...

The "here document" alternative looks like this:

#!/bin/bash
interactive−program <<LimitString
command #1
command #2
...
LimitString

Choose a limit string sufficiently unusual that it will not occur anywhere in the command list and confuse matters.
Note that here documents may sometimes be used to good effect with non−interactive utilities and commands.

[stephan411]

Hi,

does this also work?

#!/bin/bash
fw tab -t IKE_SA_table -x
yes


Thank you,
Stephan

[kva.kva]

No, you code will not work.
In your example yes is second command after first, isn't answer for 1'st command's question.

[fdamstra]

In the "there's more than one way to do it" category, you could also do:

#! /bin/bash
echo yes | fw tab -t IKE_SA_table -x

Which to me is a bit clearer, provided you understand that the '|' character means "Send the output of this command to this other command."