IPS Update: ips scheduled update ended with errors

Check the internet connection on SMC and Check dns config to see updates.checkpoint.com resolves to an IP.

To manually update the IPS database;

1- Close all GUI applications,
2- Open a GUIDBEdit to the SMC (Application:GuiDBedit.exe)
3- Search (Search->Find) for: autoupdate_and_install_status_obj

Once found you will see a field named status under that object.

4- Change the value of status 0
5- Save changes,close GUIDBEDIT
6- Open Dashboard and verify if the issue resolved.

Note : There is a fix for this issue, Request it from Support.

ClusterXL - Do not Consume Public IPs for ClusterXL

Configuring Cluster Addresses on Different Subnets

Only one routable IP address is required in a ClusterXL cluster, for the virtual cluster interface that faces the Internet. All cluster member physical IP addresses can be non-routable.Configuring different subnets for the cluster IP addresses and the member addresses is useful in order to:

- Enable a multi-machine cluster to replace a single-machine gateway in a pre-configured network, without the need to allocate new addresses to the cluster members.
- Allow organizations to use only one routable address for the ClusterXL Gateway Cluster. This saves routable addresses.

ClusterXL virtual IPs and your members physical (or VLAN) interfaces do not need to be on the same subnet. So you can simply use whichever addresses you like for each of the cluster interfaces (apart from internal/management and external/VPN-routable interfaces obviously). And of course this applies to physical untagged interfaces unlike our case too.
I settled for using  tiny Class B private space /30 subnets for each VLAN, enough for just our 2 cluster members like this. The topology would then look like this.

Smart Event & Reporter (CPU Peaks)

# evstop

# rm –r * $RTDIR/distrib/*

# evstart

SmartEvent konsolu içersinden policy install yapalım.

If not resolved,

# fw debug cpsemd on TDERROR_ALL_ALL=5

# fw debug cpsead on TDERROR_ALL_ALL=5

to end debug;

# fw debug cpsemd off TDERROR_ALL_ALL=0

# fw debug cpsead off TDERROR_ALL_ALL=0

Then check these files $RTDIR/log/cpsemd.elg* and $RTDIR/log/cpsead.elg*

Check Point - Identity Awareness (Security Event Logs)

Check Point Identity Awareness (had to supply all PDC in order to capture all IA.)

AD Query reads these events from the Security Event log:
 On Windows Server 2003 domain controllers - 672, 673, 674
 On Windows Server 2008 domain controllers - 4624, 4769, 4768, 4770

If the domain controller does not generate these events (by default they are generated), refer to Microsoft Active Directory documentation for instructions on how to configure these events.

VPN Debugging – Check Point

Vpn debug on – vpn debug off

$FWDIR/log/vpnd.elg

Vpn debug ikeon // vpn debug ikeoff

$FWDIR/log/ike.elg

vpn tu // remove all Sas for either the peer which are about the create the tunnel or all tunnels.

fw monitor –e ‘accept src=IP or dst=IP;’

SmartDashboard Connectivity Issues

Cpwd_admin list // check for the fwm whether it is up

fw debug fwm 0 TDERROR_ALL_ALL=5

tail –f $FWDIR/log/fwm.elg

Network Troubleshooting – Check Point

Route –n > routes.txt

ifconfig  -a > interfaces.txt

SecureXL is enabled or disabled <check on cpconfig>

fw monitor -e "accept src=IP_Number or dst=IP_Number;" -o monitor.out

fw ctl zdebug + drop > ctlzdebug.txt

fw ctl zdebug + dtop > ctlzdebug2.txt

[to stop the logging  “Ctrl + C”]

Removing old Check Point packages and files after an upgrade

Check Point releases a great script which erases old CP packages and files causing disc issues later on. Here it is;

Solution ID: sk91060 Product: Security Gateway, Security Management, 2012 Models Security Appliances, UTM-1, Power-1, Smart-1 Version: R70, R71, R75, R75.10, R75.20, R75.30, R75.40, R75.40VS OS: SecurePlatform 2.6, Gaia Platform / Model: All Date Created: 08-Jan-2013 Last Modified: 20-Jan-2013 Rate this document [Click on the stars to rate]

SYMPTOMS

After an upgrade, the packages of the old version are not deleted automatically. For example, when upgrading from R71 to R75, the old R71 packages and files remain on the system. This could lead to a disk space issue, especially after several upgrades.

Checkpoint IPSec VPN with Non-Checkpoint Products (Such as, PFsense, DrayTek etc.)

Non-Check Point products does not have "ike_use_largest_possible_subnets (supernetting)" feature, this is the reason why we need to disable that feature on Check Point.

(Exchanging keys with another vendor gateway uses largest possible subnet –Check Point uses the best possible subnet to increase the performance while doing IKE key exchanges by default)

DNS packets should not be allowed firstly, otherwise that results DNS resolution problems for VPN domains.

------------------------------------------------------------------------------------

# dbedit

Enter Server name (ENTER for 'localhost'): 



Enter User Name: fwadmin

Enter User Password: abc123

Checkpoint Policy Installation (a lot of buggy stuff)

- No traffic
- while installing policy, a lot of non-meaningful messages;

Firstly, Check /opt whether it is full or not.. It is vital. believe me.