Check Point - Identity Awareness (Security Event Logs)

Check Point Identity Awareness (had to supply all PDC in order to capture all IA.)

AD Query reads these events from the Security Event log:
 On Windows Server 2003 domain controllers - 672, 673, 674
 On Windows Server 2008 domain controllers - 4624, 4769, 4768, 4770

If the domain controller does not generate these events (by default they are generated), refer to Microsoft Active Directory documentation for instructions on how to configure these events.

VPN Debugging – Check Point

Vpn debug on – vpn debug off

$FWDIR/log/vpnd.elg

Vpn debug ikeon // vpn debug ikeoff

$FWDIR/log/ike.elg

vpn tu // remove all Sas for either the peer which are about the create the tunnel or all tunnels.

fw monitor –e ‘accept src=IP or dst=IP;’

Network Troubleshooting – Check Point

Route –n > routes.txt

ifconfig  -a > interfaces.txt

SecureXL is enabled or disabled <check on cpconfig>

fw monitor -e "accept src=IP_Number or dst=IP_Number;" -o monitor.out

fw ctl zdebug + drop > ctlzdebug.txt

fw ctl zdebug + dtop > ctlzdebug2.txt

[to stop the logging  “Ctrl + C”]

SmartDashboard Connectivity Issues

Cpwd_admin list // check for the fwm whether it is up

fw debug fwm 0 TDERROR_ALL_ALL=5

tail –f $FWDIR/log/fwm.elg

Removing old Check Point packages and files after an upgrade

Check Point releases a great script which erases old CP packages and files causing disc issues later on. Here it is;

Solution ID: sk91060 Product: Security Gateway, Security Management, 2012 Models Security Appliances, UTM-1, Power-1, Smart-1 Version: R70, R71, R75, R75.10, R75.20, R75.30, R75.40, R75.40VS OS: SecurePlatform 2.6, Gaia Platform / Model: All Date Created: 08-Jan-2013 Last Modified: 20-Jan-2013 Rate this document [Click on the stars to rate]

SYMPTOMS

After an upgrade, the packages of the old version are not deleted automatically. For example, when upgrading from R71 to R75, the old R71 packages and files remain on the system. This could lead to a disk space issue, especially after several upgrades.

SOLUTION

A new script was developed in order to remove all old packages and files from the upgraded machine. Important Note: The script can be used only on SecurePlatform OS and on Gaia OS running Check Point R70 and higher versions. Follow these steps to remove all old packages and files: Download the shell script from here. Log in to Expert mode by running the expert command. Copy the RemoveOldVersion.sh script to the relevant machine (for example, /var/log/ directory). Assign the execute permissions to the script: [Expert@HostName]# chmod u+x /var/log/RemoveOldVersion.sh Run the script: [Expert@HostName]# cd /var/log/ [Expert@HostName]# ./RemoveOldVersion.sh The script performs the following operations: Creates a detailed log file: /var/log/RemoveOldVersion.elg Uninstalls all old RPM packages, except these: CPrt (Eventia products) CPinfo (CPinfo utility) CPuepm (Endpoint Security Server) CPda (Deployment Agent) Deletes all directories and files that were installed by old RPM packages (except those mentioned above): /opt/<package> /var/opt/<package> /var/OPT/<package> /opt/CPshrd-* /var/log/CPsuite-* Once the script completes its job, the user will get the prompt back. To verify that the script has finished successfully, run the following commands: [Expert@HostName]# rpm -qa | grep CP [Expert@HostName]# ls -l /opt/CP* [Expert@HostName]# ls -l /var/opt/CP* [Expert@HostName]# ls -l /var/log/CPsuite-* Notes: The outputs should show only the latest version (to which the system was upgraded). These directories are not deleted: CPrt (Eventia products) CPinfo (CPinfo utility) CPuepm (Endpoint Security Server) CPda (Deployment Agent)

Checkpoint IPSec VPN with Non-Checkpoint Products (Such as, PFsense, DrayTek etc.)

Non-Check Point products does not have "ike_use_largest_possible_subnets (supernetting)" feature, this is the reason why we need to disable that feature on Check Point.

(Exchanging keys with another vendor gateway uses largest possible subnet –Check Point uses the best possible subnet to increase the performance while doing IKE key exchanges by default)

DNS packets should not be allowed firstly, otherwise that results DNS resolution problems for VPN domains.

------------------------------------------------------------------------------------

# dbedit

Enter Server name (ENTER for 'localhost'): 



Enter User Name: fwadmin

Enter User Password: abc123



Please enter a command, -h for help or -q to quit: 

dbedit> modify properties firewall_properties ike_use_largest_possible_subnets false



dbedit> update properties firewall_properties

firewall_properties updated successfully.



dbedit> quit

#

-----------------------------------------------------------

and You can configure the "max_subnet_for_range" table in "user.def" file on the Security Management Server / Domain Server. This table is designed to force VPN-1/FireWall-1 to negotiate IPSEC SAs using a specific subnet mask for a given IP address range;

max_subnet_for_range = {<first_IP_in_range, last_IP_in_the_range; subnet_mask>, <first_IP_in_range, last_IP_in_the_range; subnet_mask>, <first_IP_in_range, last_IP_in_the_range; subnet_mask>};

Example;

#ifndef __user_def__ 
#define __user_def__ 
// // User defined INSPECT code//
max_subnet_for_range = {<0.0.0.0, 10.29.39.255; 255.255.255.0>,<10.29.40.0, 10.29.50.255; 255.255.255.255>,<10.29.51.0, 255.255.255.255; 255.255.0.0>};#endif /* __user_def__ */

Checkpoint Policy Installation (a lot of buggy stuff)

- No traffic
- while installing policy, a lot of non-meaningful messages;

Firstly, Check /opt whether it is full or not.. It is vital. believe me.