I’ve been doing Checkpoint quite a lot, actually for years now. And this inevitably involves communicating with the Checkpoint Technical Assistance Centre (TAC) . And while you can easily come up with impression that it is pretty bad (look around at cpug.org) for heated flames about that), my view …
I happen from time to time to configure from scratch some Checkpoint UTM/Open Server that is thousand miles away. And from experience the best way to do it is when you have out-of-band fast access to the firewall. Of course not always such well-organized beforehand set up is available …
Not a groundbreaking idea but worth remembering that you can also run scheduled fw monitor using the cron. In case you have some problem occurring at the late night hours or you want to run debug at night when system is loaded less or put your case here this is …
Do we need to fix all the problems all the time ? My answer is no. Also I believe in good solution today and dismiss ideal solutions tomorrow. Let me show this on the real case with one of the clients. Client has Checkpoint, lots of Checkpoint, just heaps of it …
Radius Athentication - I got asked few times on this feature, and as surfing through the Checkpoint docs can be a bit tedious, I‘ll put it here. SSH user authentication against external server, in this case using Radius protocol, is possible but only if you have VPN Pro featured firewall …
This one will be short, just a link to the Tobias Lachmann blog where he shows how using dmidecode you can know what is the version of the UTM you are logged in. Determine UTM-1 appliance series from cli ~~blog.lachmann.org/?p=172~~ the site is down, look here …
Today I want to draw your attention to often overlooked information source – Checkpoint state tables. While running, the firewall creates, keeps and updates various tables it needs for correct functioning. These tables contain parameters that are mostly of use for firewall itself, but you can query them on the cli …
Some time ago Telnet from inside Checkpoint firewall I wrote how to use awk to imitate telnet in Checkpoint firewall. Later in comments to that post the reader pointed out that there is a native telnet client located on the Splat installation iso image. That’s true , only I think …
Quite often I need to work on the Checkpoint firewall access to which in SmartDashboard is close to impossible due to the overloaded internet connection to the firewall and there is no out of band access alternative. Other times doing debug produces huge files (we talk gigabytes here) and if …
I updated the script and moved it to the 1st page : http://yurisk.info/2012/01/31/awk-weekly-rule-hits-statistics-checkpoint-again/ Follow me on https://www.linkedin.com/in/yurislobodyanyuk/ not to miss what I publish on Linkedin, Github, blog, and more.