Check point block a single IP address

 

Using Suspicious Activity Monitoring (SAM)

Connect to the firewall via SSH and log into Expert mode:

expert

Run the fw sam command to block traffic to and from the target IP:
fw sam -t 0 -b -s <IP_Address>
• -t 0 sets the timeout (0 means indefinite, or specify seconds like -t 3600 for 1 hour).
• -b blocks both source and destination directions.
• -s specifies the source IP address to block. [1]

Alternatively, for high-performance accelerated drops using SecureXL, you can use the fwaccel dos deny utility: [1]

fwaccel dos deny -a <IP_Address>

fw samp block -d <IP-Address> -u <Unique-Name>

fw samp unblock -u block_bad_ip
 

Useful Check Point Commands

 

Useful Check Point Commands

Table 1. Useful CP Commands

Command	Description
cpconfig	change SIC, licenses and more
cpview -t	show top style performance counters
cphaprob stat	list the state of the high availability cluster members. Should show active and standby devices.
cphaprob -a if	display status of monitored interfaces in a cluster
cphaprob -l list	display registered cluster devices and status
cphaprob syncstat	display sync transport layer statistics
cphaprob ldstat	display sync serialization statistics
cphastop	stop a cluster member from passing traffic. Stops synchronization. (emergency only)
clusterXL_admin down –p	disable this node from cluster membership
cphaconf cluster_id get	get cluster Global ID membership
cphaconf set_ccp broadcast/multicast	set cluster mode
cplic print	license information
cpstart	start all checkpoint services
cpstat fw	show policy name, policy install time and interface table
cpstat ha	high availability state
cpstat blades	top rule hits and amount of connections
cpstat os -f all	checkpoint interface table, routing table, version, memory status, cpu load, disk space
cpstat os -f cpu	checkpoint cpu status
cpstat os -f multi_cpu	checkpoint cpu load distribution
cpstat os -f sensors	hardware environment (temperature/fan/voltage)
cpstat os -f routing	checkpoint routing table
cpstat mg -f log_server	monitor log servers performance (events/sec)
cpstat -f log_connection fw	monitor log servers settings
cpstop	stop all checkpoint services
cpwd_admin monitor_list	list processes actively monitored. Firewall should contain cpd and vpnd.
show sysenv all	show hardware sensors (fans,power supply,temp,volt)
show asset all	show serial numbers and hardware info
show route destination xx.xx.xx.xx	show routing for specific host
ip route get xx.xx.xx.xx	show routing for specific host
iclid / show cluster state	show cluster fail over history
promote_util	promote the Secondary Management server to become the Primary server
cp_conf sic init key123 norestart	reset SIC without restarting the firewall process

Useful FW Commands

Table 2. Useful FW Commands

Command	Description
fw ver	firewall version
fw ctl iflist	show interface names
fw ctl pstat	show control kernel memory and connections
fwaccel stat	show SecureXL status
fw fetch <manager IP>	get the policy from the firewall manager
fwm load <policy name> <gateway name>	compile and install a policy on the target's gateways.
fw getifs	list interfaces and IP addresses
fw log	show the content of the connections log
fw log -b "MMM DD, YYYY HH:MM:SS" "MMM DD, YYYY HH:MM:SS"	search the current log for activity between specific times
fw log -c drop	search for dropped packets in the active log; also can use accept or reject to search
fw log -f	tail the current log
fwm logexport -i <log name> -o <output name> -n -p	export an old log file on the firewall manager
fw logswitch	rotate logs
fw lslogs	list firewall logs
fw stat	firewall status, should contain the name of the policy and the relevant interfaces.
fw stat -l	show which policy is associated with which interface and package drop, accept and reject
fw tab	displays firewall tables
fw tab -s -t connections	number of connections in state table
fw tab -f -t vpn_routing -u	routing for remote vpns
fw tab -s -t userc_users	number of remote users connected (VPN)
fw tab -t xlate -x	clear all translated entries
fw unloadlocal	clear local firewall policy
fw monitor -e "accept host(10.1.1.10);"	trace the packet flow to/from the specified host
fw ctl zdebug + drop | grep 'x.x.x.x\|y.y.y.y'	Check reason of your packet being dropped

 

Updatable objects appear as 'no longer supported'

 

Symptoms

• In some scenarios, the following validation warning appears on an updatable object: "Object is no longer supported. Enforcing security for this object is not possible." However, the object is still available in the updatable objects picker.

Solution

Updatable objects use CloudGuard infrastructure. To resolve this issue:

1. Restart the CloudGuard controller by running these commands on the Security Management Server:

   • cloudguard stop

   • cloudguard start

2. Open the updatable objects pane

Notes:

• If you are using Smart-1 Cloud Contact Check Point Support to solve the issue.
• If you are using Multi-Domain Management Server, run the commands on the MDS level.

 

Checkpoint enable ICMP redirects

 

To enable ICMP redirects, configure the global kernel parameter fw_icmp_redirects=1 on the Security Gateway.

• To change the parameter On-the-fly:
  1. Run the command: # fw ctl set int fw_icmp_redirects 1
  2. Verify the new parameter setting with: # fw ctl get int fw_icmp_redirects

To set the parameter value to survive reboot (see details in sk26202)

1. Edit the $FWDIR/boot/modules/fwkern.conf file.
2. Add the line: fw_icmp_redirects=1
3. Reboot

 

Windows Firewall - Allow IP address

In rule 

netsh advfirewall firewall add rule name="Name" dir=in action=allow protocol=ANY remoteip=10.20.0.30

Out rule

netsh advfirewall firewall add rule name="Name" dir=out action=allow protocol=ANY remoteip=10.20.0.30

 

 

Enable Service in centos 9 firewall (firewalld)

 

1. 1. Add a profile for SNMP to firewalld.

      nano /etc/firewalld/services/snmp.xml

      Contents of the file is as following (Please mind the using of udp port 161)

      <?xml version="1.0" encoding="utf-8"?>
      <service>
      <short>SNMP</short>
      <description>SNMP protocol</description>
      <port protocol="udp" port="161"/>
      </service>

   2. Reload your firewall for checking any error

      firewall-cmd --reload

   3. Add the service to your public zone

      firewall-cmd --zone=public --add-service snmp --permanent

   4. Reload your firewall again

      firewall-cmd --reload

Now Test Snmp Status from another server

snmpwalk -v 2c -c public IP.of.target.server

Check the hard drive integrity - firewall checkpoint 5800

 To check the integrity of a hard drive in the Gaia/SecurePlatform OS:

    Connect to the machine over console (serial).

    Reboot the machine.

    Press a key on the "Press any key to see the boot menu" screen. The Check Point Boot Menu now opens.

    Select the "Start in maintenance mode".

    Enter the Expert mode credentials.

    Unmount the file system:

    # umount -a

    For the EXT3 file system, run the applicable 'fsck' commands (skip this step if you have a XFS file system):

        Check and update the bad block list, but do NOT repair:

        # fsck -f -n -c -v

        Repair automatically:

        # fsck -f -p -c -v

        Note: If you detect inconsistencies, 'fsck' may require the user to remove the '-p' flag from the syntax. In such a case, use the 'fsck -f -y' command instead to assume 'yes' to all questions.

        # fsck -f -c -v -y
        # sync
       # reboot

DFSR Firewall ports

DFSR Firewall ports

ICMP Echo
Port 53 DNS TCP and UDP  
Port 88 LDAP TCP and UDP
Port 135 Netbios TCP
Port 139 Netbios TCP
Port 138 NTP TCP and UDP
Port 123 time
Port 455 Kerberos TCP
Port 389 LDAP SSL TCPP
Port 636 Microsoft DFS TCP
Port 5722 Microsoft DFSR TCP
Port 49154 Netbios TCP and UDP
Port 49155 Active Directory Trust Policy TCP
Port 49158 CFS TCP and UDP