Check Point Usefull Commands

My personal collection of CheckPoint Commands.

Most of them work best in expert mode.

[Expert@gateway:0]#

CommandDescription
cpconfigchange SIC, licenses and more
cpview -tshow top style performance counters
cphaprob statlist the state of the high availability cluster members. Should show active and standby devices.
cphaprob -a ifdisplay status of monitored interfaces in a cluster
cphaprob -l listdisplay registered cluster devices and status
cphaprob syncstatdisplay sync transport layer statistics
cphaprob ldstatdisplay sync serialization statistics
cphastopstop a cluster member from passing traffic. Stops synchronization. (emergency only)
clusterXL_admin down –pdisable this node from cluster membership
cphaconf cluster_id getget cluster Global ID membership
cphaconf set_ccp broadcast/multicastset cluster mode
cplic printlicense information
cpstartstart all checkpoint services
cpstat fwshow policy name, policy install time and interface table
cpstat hahigh availability state
cpstat bladestop rule hits and amount of connections
cpstat os -f allcheckpoint interface table, routing table, version, memory status, cpu load, disk space
cpstat os -f cpucheckpoint cpu status
cpstat os -f multi_cpucheckpoint cpu load distribution
cpstat os -f sensorshardware environment (temperature/fan/voltage)
cpstat os -f routingcheckpoint routing table
cpstat mg -f log_servermonitor log servers performance (events/sec)
cpstopstop all checkpoint services
cpwd_admin monitor_listlist processes actively monitored. Firewall should contain cpd and vpnd.
show sysenv allshow hardware sensors (fans,power supply,temp,volt)
show asset allshow serial numbers and hardware info
show route destination xx.xx.xx.xxshow routing for specific host
ip route get xx.xx.xx.xxshow routing for specific host
iclid / show cluster stateshow cluster fail over history
promote_utilpromote the Secondary Management server to become the Primary server
cp_conf sic init key123 norestartreset SIC without restarting the firewall process
fw verfirewall version
fw ctl iflistshow interface names
fw ctl pstatshow control kernel memory and connections
fwaccel statshow SecureXL status
fw fetchget the policy from the firewall manager
fwm loadcompile and install a policy on the target’s gateways.
fw getifslist interfaces and IP addresses
fw logshow the content of the connections log
fw log -b “MMM DD, YYYY HH:MM:SS” “MMM DD, YYYY HH:MM:SS”search the current log for activity between specific times
fw log -c dropsearch for dropped packets in the active log; also can use accept or reject to search
fw log -ftail the current log
fwm logexport -i -o -n -pexport an old log file on the firewall manager
fw logswitchrotate logs
fw lslogslist firewall logs
fw statfirewall status, should contain the name of the policy and the relevant interfaces.
fw stat -lshow which policy is associated with which interface and package drop, accept and reject
fw tabdisplays firewall tables
fw tab -s -t connectionsnumber of connections in state table
fw tab -f -t vpn_routing -urouting for remote vpns
fw tab -s -t userc_usersnumber of remote users connected (VPN)
fw tab -t xlate -xclear all translated entries
fw unloadlocalclear local firewall policy
fw monitor -e “accept host(10.1.1.10);”trace the packet flow to/from the specified host
fw ctl zdebug + drop | grep ‘x.x.x.x\|y.y.y.y’Check reason of your packet being dropped

One-liner for Address Spoofing Troubleshooting

One-liner (Bash) to show a summary about each interfaces’ calculated topology and address spoofing setting.
$FWDIR/state/local/FW1/local.set contains all required information regarding interfaces and their topology. 

echo; egrep -B1 $'ifindex|:ipaddr|\(\x22<[0-9]|has_addr_info|:monitor_only|:external' $FWDIR/state/local/FW1/local.set | sed 's/[\x22\t()<>-]//g' | sed '$!N;s/\n:ipaddr6/ IPv6/;P;D' | sed '/IPv6/!s/://g' | sed 's/interface_topology/\tCalculated Interface Topology/g' | sed '0,/ifindex 0/{/ifindex 0/d;}' | sed '/ifindex 0/q' | sed '/spoof\|scan/d' | sed 's/has_addr_info true/\tAddress Spoofing Protection: Enabled/g' | sed 's/has_addr_info false/\tAddress Spoofing Protection: Disabled/g' | sed -e '/Prot/{n;d}' | sed '$!N;s/\nmonitor_only true/ (Detect Mode)/;P;D' | sed '$!N;s/\nmonitor_only false/ (Prevent Mode)/;P;D' | sed '$!N;s/\nexternal false/ - Internal Interface/;P;D' | sed '$!N;s/\nexternal true/ - External Interface/;P;D' | tac | sed '/ifindex 0/I,+2 d' | tac | sed '/ifindex/d' | sed 's/,/ -/g' | sed '$!N;s/\nipaddr/ >/;P;D' | sed '/ - /s/^ /\t/' | egrep -C 9999 --color=auto $'>|IPv6|External|Disabled|Detect'; echo‍‍‍‍‍‍‍‍‍‍
Links
Blog at WordPress.com.