CPUG: The Check Point User Group

Resources for the Check Point Community, by the Check Point Community.


Tim Hall has done it again! He has just released the 2nd edition of "Max Power".
Rather than get into details here, I urge you to check out this announcement post.
It's a massive upgrade, and well worth checking out. -E

 

Search:

Type: Posts; User: alienbaby

Page 1 of 5 1 2 3 4

Search: Search took 0.02 seconds.

  1. Re: Firewall Policy Achitecture and Best Practices

    I agree that ultimately policy creation and management should/will be automated. Be it should be done so using a methodology such as the one above. Otherwise, you're going to encounter...
  2. Re: Firewall Policy Achitecture and Best Practices

    You're right that the methodology does not address acceleration. Its about consistency in policy creation and day-to-day management. And I would argue that if your everyday corporate firewall needs...
  3. Re: Can the standby cluster member use the phsyical IP address

    There are two or three under-the-hood solutions to this problem.

    Personally, I prefer the out-in-the-open solution.

    The table.def changes are hidden, and you have to remember that you did...
  4. Re: Firewall Policy Achitecture and Best Practices

    The methodology is open to expansion and is specific to CheckPoint for Simplied Mode and Traditional Mode policy (pre-R80 stuff).. mostly simplified mode. It also does not address several silly...
  5. Replies
    10
    Views
    3,515

    Re: ClusterXL unexpected/hidden failover

    If you don't see any Control messages, then the firewall didn't fail-over.

    It was likely a failure of some other device.
  6. Replies
    38
    Views
    12,366

    Re: R80.10 Public Early Availability

    Updated kernel? or still 9 year old tech?

    Hows tcpdump? is it 5+ years out of date too?

    bash?

    The small stuff counts. It the biggest complaint many of my customers have. CheckPoint's...
  7. Re: werid NAT show up in SmartDashboard. is that normal?

    Are you using a network object with a 32-bit mask instead of a host object for tranny destination?
  8. Re: Check Point Recommends Reboots Every 90 Days?

    <pile on>

    You should probably reboot your CheckPoint appliances every 24 hours, given that CheckPoint does not use ECC RAM.

    Reference: https://en.wikipedia.org/wiki/ECC_memory



    5 single...
  9. Replies
    31
    Views
    10,446

    Re: ClusterXL Issue with Failover

    Nope.. didn't miss anything..

    ClusterXL troubleshooting starts with those two commands..

    cphaprob -a if
    cphaprob -i list

    Much clue dust will come bursting forth..
  10. Replies
    31
    Views
    10,446

    Re: ClusterXL Issue with Failover

    So much bad advice being given..

    varera is the only one I see asking reasonable questions..

    When troubleshooting ClusterXL, you must always start with the output from the following commands:
    ...
  11. Replies
    13
    Views
    6,652

    Re: no vlan 1 in gaia interface configuration

    That won't exactly work.. That scheme will only work in one direction.. from firewall to switch.. and that's assuming the switch isn't smart enough to recognize that; Hey, I should have gotten this...
  12. Replies
    13
    Views
    6,652

    Re: no vlan 1 in gaia interface configuration

    Resurrection is a real thing. Just look at this thread.. :)

    "Native VLAN" is a cisco term for untagged ethernet frames on a trunk interface.

    You can configured the base interface and have...
  13. Re: How do I establish route based VPN with MPLS as well as ISP links

    Easy.. Re-architect the network. placement of the ISP and MPLS in relation to each other; treat both services as untrusted.

    Make the ISP router, and the MPLS router equal.. place them next to...
  14. Replies
    9
    Views
    10,046

    Re: NAT and Palo Alto

    Having created some of the best hacks known to man, I know a hack when I see one...

    And that's a hack.. logically, if I can do a source of 0.0.0.0/0.0.0.0, then 'Any' should work as well.

    So...
  15. Replies
    9
    Views
    10,046

    NAT and Palo Alto

    I have observed a Palo Alto do the following:

    Original Source: Any -> Original Destination: Some subnet or IP -> Translated Source: outgoing Interface (or whatever IP you like) [Hide] .. ...
  16. Replies
    52
    Views
    8,247

    Re: Migrate Provider-1 R75.47 to R80

    Are you doing this upgrade for giggles? Or are you actually intending to run R80 in production?
  17. Replies
    7
    Views
    22,005

    Re: INVALID-ID-INFORMATION

    The PIX is sending you all zeros for the Proxy IDs. This is equivalent to CheckPoint's 'One tunnel per gateway pair' in tunnel management.

    You'll also see this with Tunnel Interfaces on Cisco...
  18. Replies
    10
    Views
    4,019

    Re: ClusterXL on r77.10 dropping igmp messages

    If FIBMGR sessions are being dropped between cluster members, then you have one of two problems:

    1. Your topology is not configured properly.
    2. You disabled 'accept control connections' in...
  19. Replies
    35
    Views
    15,601

    Re: NTP not syncing - Gaia

    For NTP to work, you must have the following conditions:

    1. System time should be within one hour of the NTP server's time.
    2. For the secondary cluster member to properly communicate , you...
  20. Re: VTI/Route Based VPN supported by 3rd party systems as well?

    Unless you're building a VPN tunnel that requires a routing protocol, there is no reason to use VTI.

    Setup a standard Star VPN Community and set it to to "One VPN tunnel per Gateway pair".

    In...
  21. Re: VTI/Route Based VPN supported by 3rd party systems as well?

    I can't find any reference for this limitation. Can you provide a link?
  22. Re: VTI/Route Based VPN supported by 3rd party systems as well?

    What problem are you trying to solve?
    There is a likely a better way..
  23. Replies
    11
    Views
    5,053

    Re: Checkpoint VRRP - new install

    Granted.. Solaris and/or Stonebeat were operational nightmares.




    VRRP, even in GAIA, is separate from ClusterXL.
    ClusterXL is not aware of VRRP.
    VRRP on GAIA operates separate from...
  24. Replies
    4
    Views
    1,508

    Re: Manual NAT Problem

    As mentioned, do Hide NAT.. I note the XlateSrc is listed, but not Xlatesrc port.

    Also, validate the 192.168.1.1 object.. maybe there is a typo..
  25. Replies
    11
    Views
    5,053

    Re: Checkpoint VRRP - new install

    These analogies are not even remotely accurate.

    VRRP is a dumb protocol. VRRP was created for routers that have no need for statefulness and in fact do not do access control what so ever. RFC...
  26. Re: Site-2-site vpn between Checkpoint R75.47/R77.30 and Cisco IOS router

    This is normal..

    When you install policy, by default, all VPN keys are flushed and the VPNs have to re-key..

    If you watch the logs on the Cisco device, you should notice some IKE IPSec SA...
  27. Replies
    6
    Views
    3,892

    Re: ClusterXL - Split Brain

    Re-image.. re-install.. from scratch.. take nothing along except the contents from 'show configuration"..
  28. Replies
    6
    Views
    3,892

    Re: ClusterXL - Split Brain

    There are two ways to make ClusterXL go Split Brain..

    1. Different Magic MAC on each cluster member.
    2. The switch is dropping all Multicast and Broadcast frames for all firewall interfaces;...
  29. Replies
    9
    Views
    1,826

    Re: Change firewall own IP address

    SIC is based on PKI. So no IP addresses involved, except the Management Server.. Names only. Notice how you can't change the name of the gateway once SIC is initialized.

    Test SIC Status is an...
  30. Replies
    14
    Views
    2,844

    Re: VRRP different hardware

    Over thinking is the proposed solution.

    It would be simpler to just trade in the old 5070 appliance and purchase an identical 12400 appliance and implement a normal, universally supportable...
  31. Replies
    4
    Views
    1,444

    Re: Many to one NAT - Public to Internal

    If you know the source IP, then you can Hide NAT it..

    You can not Hide NAT 'Any' Source.


    OutsideIP/OutsideNetwork -> PublicServerIP -> Any ; InternalIP(Hide) -> PrivateServerIP (or...
  32. Replies
    14
    Views
    2,844

    Re: VRRP different hardware

    VRRP Yes.

    Clustering NO.

    Modern CheckPoint code requires the platforms be identical. Mostly because of CoreXL. CoreXL worker 01 on cluster member A state syncs to worker 01 on cluster member...
  33. Replies
    0
    Views
    1,240

    cphamcset and memory usage

    I've encountered a problem involving cphamcset.

    Firewalls are a range from R65 to R71 managed by R77.20.. It's clear that later versions of CheckPoint Management compiling policy for earlier...
  34. Thread: fw ctl arp

    by alienbaby
    Replies
    6
    Views
    2,986

    Re: fw ctl arp

    Your interfaces use Dynamic ARP by default. When you want to transmit a packet, your host looks up the MAC address of the locally connected recipients in it's own ARP table. If no entry exists, it...
  35. Thread: fw ctl arp

    by alienbaby
    Replies
    6
    Views
    2,986

    Re: fw ctl arp

    'fw ctl arp' displays the proxy ARPs handled by the firewall kernel module. This use to be only for ClusterXL only, but I believe this now applies to single gateway firewalls as well in more recent...
  36. Replies
    14
    Views
    7,518

    Re: AWS Checkpoint firewall clustering

    I'm gonna inject a tangent..

    Is clustering in AWS a reasonable architectural decision? The two cluster members have to be in the same Availability Zone.
    If Amazon takes down the availability...
  37. Replies
    8
    Views
    2,875

    Re: Secondary Cluster IP

    I see three options.

    1. Deploy a separate VPN solution into the VPC, such as a CheckPoint Firewall for AWS..
    2. Multiple Internet facing interfaces on the CheckPoint cluster.
    3. XXX - Build a...
  38. Replies
    12
    Views
    10,648

    Re: Cisco NEXUS 5000 drops ccp

    A. If you're routing multicast, then fix your IGMP.
    B. If you're not routing multicast, then disable IGMP.

    Enabling broadcast mode is not the same as disabling IGMP. Yes, the switch will...
  39. Replies
    2
    Views
    2,312

    Re: IPv6 Stateless Autoconfiguration

    I'm not aware of GAIA having a service that would send out the advertisements required for IPv6 autoconfguration (SLAAC). In linux, this is RADVD, but I could see CheckPoint adding it to...
  40. Re: Network Design/Routing - FW and hosts on different subnets

    Ahh.. You don't have a overall architectural issue, you have an Service Level problem within you network team.

    But, you do also have a architectural issue, or lack thereof, since you mention they...
  41. Re: Network Design/Routing - FW and hosts on different subnets

    1. What is impractical about keeping your customers segmented from each other? It's simple linear scaling..
    2. Is the segmentation a selling point or a requirement that has been placed on you by...
  42. Replies
    11
    Views
    2,325

    Re: has anyone seen this before with R75.47?

    You misunderstand.

    The fwm and other processes are all 32-bit and single-threaded. Meaning each 32-bit process only sees a 4GB memory space. Regardless of the OS mode, 32-bit or 64-bit.. And...
  43. Re: Migrate clusterXL from High Avaibility to Load Sharing

    Support is being an idiot. Do not follow the silly recommendation given to you. "Lets change the whole environment in response to one undiagnosed metric." Put that shotgun down Cowboy.

    Is that...
  44. Re: What are the issues in active-active scenario?

    Human psychological weakness is the true reason why most active/active clusters exist.

    The real result is that lots of additional complexity is introduced, and with lots of additional failure...
  45. Re: What are the issues in active-active scenario?

    From a thread in 2010.. https://www.cpug.org/forums/archive/index.php/t-14821.html

    Active/Active clusters do not improve performance. The decision function actually robs the cluster of...
  46. Re: Jumbo Hotfix Accumulator (install or not to install, that is the question).

    Simple answer.. No..

    You should only apply the hotfixes listed in CPUSE..

    You may find that you have to uninstall any hotfixes applied outside of CPUSE when you need to install a CPUSE hotfix...
  47. Re: Question about NAT and accessing the external IP from the inside

    I see multiple problems here.

    1. You state bridge mode, but then list that you have IP addresses on eth0 and eth1 interfaces. In bridge mode, you'd only have an IP address on the bridge...
  48. Re: migrate import failed with "No space left on device" error R77

    When you build test VMs for CheckPoint, do 80 GB minimum HDD.. better to do 120GB minimum.. thin provision to save space..
  49. Re: very slow intervaln communication via checkpoint

    What kind of CPU is in this box? And how many? cat /proc/cpuinfo

    2 core license, Firewall, IPS, URL filtering, VPN, Mobility and Identity Aware enabled.

    What throughput were you hoping to...
  50. Re: very slow intervaln communication via checkpoint

    1. What features do you have enabled on this gateway/cluster? (ie: IPS, App Control, URL filtering, DLP etc. )
    2. Is the gateway and/or cluster in 64-bit mode?
    3. In this GAIA?
    4. can you...
  51. Re: very slow intervaln communication via checkpoint

    R77 has a new tool called cpview.

    Use it to get some visibility into the overall performance of the box. Number of connection setups a second (cps) etc.
    Feel free to post some of those numbers..
  52. Replies
    25
    Views
    6,008

    Re: SMART-1 (not so smart)

    Did you also notice that the Mgmt port is a 100 meg? While the rest are Gig..
    Found that one when I plugged into a Gig only switch..

    ethtool -i Mgmt
  53. Replies
    31
    Views
    4,700

    Re: Recommended version for 1140 appliances

    The SG80, 600 and 1100 are ARM CPU based. They have their own train of code based on R75.20.
    The latest I'm aware of is R75.20.66.
  54. Replies
    4
    Views
    1,643

    Re: Issue with SIC establishment

    I had very problem today..
    Turned out that the clock on the remote gateway was way off..
  55. Replies
    4
    Views
    1,202

    Re: Troubleshooting VPNs

    The Checkpoint configuration is very intuitive. It should be configured based on the layer 3 headers of the packets that will be transmitted and received in the tunnel.

    Even though you'll be...
  56. Re: How do I increase disk space for my log files on SPLAT

    You can't resize the original install; Well maybe you can, but you should involve a linux systems engineer to do that.

    Two methods.

    1. Export the config. reload the OS. import the config....
  57. Re: very slow intervaln communication via checkpoint

    R77.10 and earlier have a crappy 10G driver...
    ixgbe 3.1.17..

    Upgrade to R77.20.. Upgrades the driver (increases performance) and gives you reboot survival ring buffer settings (lowers CPU...
  58. Replies
    4
    Views
    1,202

    Re: Troubleshooting VPNs

    In CheckPoint land, it's always best to use what CheckPoint calls a Domain Based VPN.. VTI's don't give you any redundancy, unless you use a routing protocol. In addition, if you don't setup NAT...
  59. Replies
    4
    Views
    2,035

    Re: SPLAT 77.20 HP Open Server

    1. On HP servers, you have to remove/kick out the built-in DVD drive in order to boot from a USB optical drive.
    2. May I ask why you're installing a dead operating system?
  60. Replies
    2
    Views
    4,271

    Re: Deploying Anti-Bot Blade

    I'm curious to know what you mean by noisy.

    I remember a story about a DBA that considered his DB IDS to be noisy. So he switched it off. Turns out, the reason it was noisy, was because a...
  61. Replies
    6
    Views
    4,626

    Re: ESP and AH Settings in Checkpoint

    CheckPoint still does not support AH..
    Not that anyone would do so.. Never actually seen a need for it.. Nor have a seen anyone run, in production, anything other than tunnel mode ESP..

    May I...
  62. Replies
    2
    Views
    3,925

    Re: VE hypervisor R77.10 is out, but.....

    It took 9 months for R77.10 VE to be released, following the the release of R77.10.

    How long will it take of the R77.20 VE hotfix to be released?

    So.. sometime around February of next year...
  63. Replies
    19
    Views
    7,516

    Re: Bash Vulnerability

    Has anyone noticed any hits on the Bash IPS Protection? Any logs from that Protection at all?
  64. Replies
    26
    Views
    16,756

    Re: Check Point R77.20

    Review the HCL. http://www.checkpoint.com/services/techsupport/hcl/

    Note that multiple platforms are only supported on GAIA. You'll find this to be the case more and more as time passes.
    And...
  65. Replies
    5
    Views
    1,283

    Re: VPN Through a Second Firewall

    Simplest and least impactful method is to add two NAT rules near the top of your NAT policy..

    Local Encryption Domain; Remote Encryption Domain; Any -> Original; Original; Original..
    Remote...
  66. Replies
    26
    Views
    16,756

    Re: Check Point R77.20

    May I ask why you're still running SecurePlatform?
  67. Re: Really slow DNS causing browser hangs when VPN connected

    I don't see you mention whether you're using SecuRemote/SecureClient/EndPoint/Mobile VPN etc.

    In order to use split DNS with CheckPoint VPN clients, you must define the internal domain name to be...
  68. Replies
    2
    Views
    2,077

    Check Point Virtual Edition Dead ?

    Is Check Point Virtual Edition Dead?

    Most recent version of VE with Hypervisor support was R75.40, and a review of the Docs for R75.45, R75.46, and R75.47 shows no mention of VE.

    I can't find...
  69. Replies
    4
    Views
    1,411

    Re: NAT when going out of cluster

    By default, traffic does not NAT as it passes through a CheckPoint firewall.

    By default, there is one exception to that rule. Traffic that originates from a cluster member, will be NAT'd behind...
  70. Re: ClusterXL in Active/standby with NAT having issues

    Also, make sure you do not rename the interfaces in topology. The interfaces names in the cluster object's topology must match the real interfaces reported by the gateway's OS.

    Renaming...
  71. Replies
    2
    Views
    6,291

    Re: message_info: Address spoofing

    Yes, create a group with all the source IP addresses using subnet/host objects.

    Rule of thumb, Anti-Spoofing should match the routing table.
  72. Re: how to make the gateway send logs to the domain server public ip

    Please don't do this.. Such a disgusting solution. Clutters up SmartView Monitor amongst other things.


    There are two solutions:


    1. Implicit behavior; assumes Anti-spoofing and routing...
  73. Replies
    2
    Views
    2,885

    Re: VPN Phase 2 - Invalid ID Information

    In tracker, expose the xlate and NAT fields.

    then check/modify your NAT rules to prevent NAT.
  74. Replies
    1
    Views
    834

    Re: auto roll over to a second NAT object

    Connect Control might be able to do that.

    You'd be better off getting a load balancer.

    You can also hack together a solution using dynamic objects, but you didnt hear that from me.
  75. Re: IA Access Role Policy fails to match traffic in Application Control Blade policy

    What version of Check Point?

    Have you checked the Resolved Issues of more recent versions?
  76. Replies
    4
    Views
    1,909

    Re: How to Schedule Snapshot on Splat?

    Horrible idea.

    Either way, you have to load Splat on the box.. And then transfer a huge snapshot file. Versus load splat, transfer a small backup, and restore it, per documented procedure.
    ...
  77. Replies
    2
    Views
    973

    Re: Routing question - Return traffic

    Short answer, No. A syn packet that enters in one firewall/cluster, if the policy allows, will be accepted. But the return packet, the syn/ack, will be quashed by the other separate...
  78. Thread: R65

    by alienbaby
    Replies
    4
    Views
    1,593

    Re: R65

    There are a few ways to gain legitimate access to file downloads.

    1. True up your software subscription.

    2. Acquire a CCSE certification. I don't recall if CCSA gives access to downloads; It...
  79. Thread: R65

    by alienbaby
    Replies
    4
    Views
    1,593

    Re: R65

    R65 and Older

    https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=388


    Legacy GUIs
    ...
  80. Re: Sessions with SRC and DST in different VLANs on same trunk dead after CL failove

    1. Validate your routing table is in sync/same.

    'ip route list' on both cluster members

    2. Validate layer 2 connectivity.

    Check ARP table for ARP entry of endpoint/gateway.

    tcpdump and...
  81. Re: RX errors increasing on External Interface of Splat firewall

    Using ethtool should give more detail on the specific rx error. It can mean that the firewall is receiving more packets than it can process. Read up on SecureXL and CoreXL.

    I recommend you...
  82. Replies
    1
    Views
    14,822

    Re: Encryption failure: no response from peer.

    It's all in the errors..

    No response from peer.

    The remote side is not responding. I recommend you conduct a tcpdump on the CheckPoint. 'tcpdump -nn -i External [or whatever interface is...
  83. Replies
    6
    Views
    2,084

    Re: Site to Site VPN errors : Very very urgent

    In Tracker, be sure to expose the four Xlate fields. The VPN might be keying up Properly, but then when you send traffic, you might be NATing.
    Also, make sure you're routing the traffic out the...
  84. Re: why do you need to set up cluster using ipso, then checkpoint dashboard ?

    There are some ways CheckPoint could make this process more efficient. The gateway's OS and CheckPoint configuration are separate.

    I generally explain it this way. CheckPoint takes a little...
  85. Replies
    3
    Views
    2,678

    Re: Multicast disable on swtich or Arp issue??

    If the switch is not consistently passing multicast frames, then anything that depends on multicast will fail.

    What version of code are you running?

    May I ask why you're running VRRP instead of...
  86. Re: Bridge/ Layer 2 Firewall connectivity and HA

    DO NOT DO IT. The stability of a CheckPoint L2 firewall is less than stellar. The last one I had the misforture to deal with, had to rebooted daily.
  87. Re: packet size issue on site to site tunnel between checkpoint firewalls

    You might can an IPS protection (CheckPoint IPS or other) that limits the size of ICMP requests; or cisco ACL etc.
  88. Re: VTIs with non checkpoint endpoints (inc sonicwall)

    If you dont have a requirement to use a routing protocol (BGP, OSPF), then create a VPN as you normally would using a VPN community. Then adjust the VPN Community's Advanced settings to do One...
  89. Replies
    13
    Views
    6,652

    Re: no vlan 1 in gaia interface configuration

    This is CheckPoint's mistaken idea about VLAN tagging. I can only think they got it from the cisco world where a native vlan defaults to 1 on a trunk interface. They didnt realize the default...
  90. Replies
    2
    Views
    2,318

    Re: About Automatic NAT and NAT exempt

    After you create your automatic NAT, create a manual NAT rule at the top of the NAT rulebase.
  91. Re: incoming through 'MGMT' and outgoing through 'DATA' under anti-spoofing 'detect'

    I don't entirely understand your explanation. I did understand that you're trying to eliminate one of these two interfaces; Mgmt or DATA.

    The primary principle of Anti-spoofing is, Anti-Spoofing...
  92. Replies
    4
    Views
    1,396

    Re: R76 upgrade using additional cluster

    Whenever I hear of cluster stability issues, I always look at the switches first.

    If switches have IGMP enabled, and environment is not doing multicast routing, then disable IGMP; or use static...
  93. Replies
    5
    Views
    1,546

    Re: 2 Gateway objects with identical IP's

    CheckPoint management servers do not like it when two CheckPoint objects have common IP addresses.

    The correct strategy to follow is to duplicate the management server and the firewall/cluster...
  94. Replies
    5
    Views
    8,507

    Re: Upgrading R75.40 to R77

    The Instructions on the download page are clear...

    The package should be usable for both GAIA and SecurePlatform via WebUI. Maybe phoneboy can get some clarity on the problem.
  95. Replies
    1
    Views
    1,064

    Re: VPN primary/backup Design Type Questions

    Check Point does not support VPN fail-over for non-CheckPoint gateways.

    That being said, you could get something working using VTI and routing protocols.

    Or you could simply buy small...
  96. Re: SYNC Interface Priority (LAN2 over eth3-01)

    Did you reboot both cluster members after changing the sync configuration?

    Any time I reconfigure the ClusterXL behavior, I reboot.
    For example, if you remove/decommision an interface, reboot to...
  97. Thread: VPN Latency

    by alienbaby
    Replies
    2
    Views
    2,539

    Re: VPN Latency

    Options:

    1. If both ends are CheckPoint, then use a One Tunnel per Gateway Pair.
    2. If both ends are CheckPoint, try setting the tunnel to Permanent.
    3. Validate that the subnets/host in the...
  98. Replies
    3
    Views
    7,485

    Re: ICA and SIC communication

    CheckPoint's SIC and ICA (Internal CA) are based on PKI and SSL/TLS.

    I recommend you go learn about PKI and SSL/TLS. Because then you'll also have a foundational knowledge.
  99. Replies
    3
    Views
    13,713

    Re: Checkpoint interface MAC address

    1. I assume you've adjusted the magic numbers on this cluster; 0x15 and some other number, 0x16?.. The switch port for the other cluster member may have a MAC like 0000.0000.1501.. If you haven't...
  100. Replies
    1
    Views
    3,202

    Re: Gaia & Jumbo Frames

    Quite a lot comes up when I search for 'MTU'. Specifically, a bad behavior with 10G and TSO when changing MTU.
Results 1 to 100 of 500
Page 1 of 5 1 2 3 4