Hello, fellow checkpoint-heads.
I know you have been waiting for this for a long long time, and now it happens – Checkpoint announced that Check Point Certified Master Architect Certification lab can be taken at “convenience of your desktop” – that is Online. You don’t need to ride your horses over the dusty Texas any more, for mere 1500US$ you can take it online and be happy ever after (me thinks you will be happy anyway, cause if you can throw away easily 1500 bucks you are all set already).
In addition their CCSA/CCSE training classes are also available online,details on their website.

There is a not critical but rather annoying bug in the Checkpoint Edge devices firmware 8.1.x preventing any host behind it to reach class A network 2.0.0.0/8 . If you notice this problem then it is most probably because recently the pool 2.16.0.0/13 was assigned to Akamai Technologies . Checkpoint have a bug-fix firmware for that , so open a ticket with them and you will get one.

Someone has finally found the best use of the Checkpoint UTM 450  –   turned it into the Windows Media player and recorded the instructions so others may follow.  In case you still wonder – yes , it certainly voids the warranty. Enjoy youtube.com And to those very few that will try to do it – word of caution: UTM 450 makes such noise you will not be able to put it in your living room.

It was rather unusual request of the client that for no matter which reasons asked me to “shut down the Checkpoint firewall”. What ? “Shutdown, you know, that it just passes the traffic from interface to interface by its routing table no checking , also I need to add few routes on the way, Okay ?” . The allocated downtime was up to few minutes , so I understood that no testing/return back/etc could be done beforehand but did what I knew and it actually worked. Here is the things I changed .
Shutdown Checkpoint with #cpstop . I looked for ways to shutdown the firewall kernel module completely but hadn’t found , so warned the client if someone does restart to the machine all is screwed.
The following settings I set in file /etc/sysctl.conf and after saving changes activated them with #sysctl –p
net.ipv4.conf.default.rp_filter = 0 // Disable RPF checks, for some reason it blocked routed networks and timelimit of 2 minutes didn’t allow debug .
net.ipv4.ip_forward = 1 // Enable routing
net.ipv4.conf.default.arp_filter = 0 // Disable ARp filtering , meaningful with networks that are reachable through multiple interfaces , while it wasn’t the case just to make sure.
net.ipv4.conf.all.arp_filter = 0

Here is how to see number of connected to the gateway users. Nothing special/interesting and I am sure somewhere in the SecureKnowledgeBase it is to be found but with recent licensing improvements people ask a lot about that.