Command Line Policy Install

[jaxlore]

Hi Folks

I hope I am posting under the right heading here. I am trying to find a way to go in update my default policy, save it. Then run a batch file at night to install the policy during down time. I have seen a reference to the "fw ctl install". But I can't tell from the documentation if this is what I need to be running or not. Any points in the right direction would be helpful. I am running NG on windows.

Thanks
-M.ke

[tgronke]

Sorry I don't know about fw ctl install, nor NG on Windows. However my team's setup guide for NG on Nokia may be helpful.

"Now that the Nokia has been configured, you are ready to configure Checkpoint via 'cpconfig'. One problem - after running 'cpconfig' the Nokia reboots in order for changes to take effect. Upon reboot, the Nokia box loads with the 'defaultfilter.pf' policy. This policy for all intents and purposes blocks all traffic. Normal procedure when faced with this is to issue the command 'fw unloadlocal' However, if you don't have console or term server access then you cannot issue this command. And of course, since defaultfilter.pf blocks everything, you will not be able to telnet/ssh to the box.

"A way around this situation is replace the defaultfilter.pf file with another IPSO specific file called 'defaultfilter.ipso_ssh' prior to running 'cpconfig'. As the name suggests, this policy will allow you to ssh into the box. From there you can remotely log into the firewall and issue the standard 'fw unloadlocal'.

"DO THIS BEFORE RUNNING THE INITIAL CPCONFIG:

- cp $FWDIR/lib/defaultfilter.ipso_ssh $FWDIR/conf/defaultfilter.pf
- fw defaultgen (this generates the default filter)
-cp $FWDIR/state/default.bin $FWDIR/boot"

You may be able to make a copy of your default policy file (looks like it was $FWDIR/lib/default.boot in my case), edit it as desired, copy the modified file to $FWDIR/conf/defaultfilter.pf, execute 'fw defaultgen' to create the default policy from the source file, then move the default.bin file to $FWDIR/boot.

If you're unfamiliar with Inspect like me, you can try copying/pasting portions from the other default policy files in $FWDIR/lib. For example, a stanza allowing incoming SSH:

all@all

accept inbound, tcp,
<[16]> in host_ip_addrs,
dport = 22,
DEFAULT_RECORD();

[jaxlore]

thanks for the response but this is a little more in depth then what I am trying to do. I do have remote access to the server, but because of the active db connections that run through it I can only install policies late at night. I would prefer just for run a batch script to install the saved policy that I have already edited later on in the evening. I have the command line interface guide and maybe I am just something I am not understanding.

[decnartne]

Check out 'fwm load'. It takes as params the fully-qualified path to your policy .pf and the name of your destination cluster or module server (at least on my OS/FW ver)

~decnartne