Finally, 10GB HP NIC is supported with Check Point

Miracles happen, even in technology world. I was informed today Check Point finally has  10 GBps optical card supported with HP hardware.

Tree years ago not having any 10 GB NIC supported with Check Point almost killed one of my VSX projects, where HP HW was planned to be used. There was a case with Check Point solution center, multiple meetings with CP executives and other numerous efforts to un-block the situation, and nothing really happened. Check Point han several 10GB NICs, but none of them were made by HP. And as you know, HP does not support "foreign" parts on their servers.

Long story short, that is no longer a case. If you are planning to run R75.40 on HP, you can have this card working in fully supported configuration. If you are running VSX, there is a driver for R67 you must use.

Update: Well, my joy must be a bit premature. According to the official specs, this card is only supported with G6 and G7 HP servers. And as you may know, G7 has end of sales by the October 2012.

Update 2: HP confirmes the mentioned card will not be supported with Gen8 line. Great news, Check Point and HP, great news indeed. /sarcasm/

E75.x Endpoint Connect Client: decrypting config file

Endpoint Connect is quite different from SecureClient, you know that. Latter has VPN site configuration in users.C file, and by default it is stored as cleartext.

E75.X client stores VPN configuration on Trac.conf file, and it is encrypted by default. If you are trying to troubleshoot some site creation issues or just curious, it might be interesting to be able to decrypt the configuration file.

This is what you need to do:

1. Login to your laptop as an administrator and locate E75.X files. Usually they are under %Program Files/CheckPoint/Endpoint Connect/ folder. Find there Trac.defaults file

2. Stop VPN client (close GUI) and then stop Check Point Endpoint Security VPN service

3. Open Trac.defaults file to edit, find OBSCURE_FILE parameter and change its value from 1 to 0.

4. Start VPN service and then the client. Trac.config file is now readable.

Tufin revolution - part of CPUG 2012

Have you see Tufin revolution banner?

Come to CPUG 2012 conference to witness that revolution in motion. Tufin is sponsoring CPUG conference and is going to announce a new exiting revolutionary way to manage your firewalls.

It is not too late to register.

Next Generation FW war is not so cold anymore?

PAN and Check Point are known to attack each other. If I understand it correctly, PAN is chasing Check Point customers for years. I guess, we need to thank them for it. That is the main reason Check Point was so aggressive to introduce Identity Awareness and Application Control features. Anti-Bot software blade is taking the race even further.

But that was a cold war two years ago. It was a feature race. Now the tention seems to get more and more hit.

PAN has hired mythbusters to show some rather humiliating competitive analysis.

Check Point did not go so far, but take look at this site, "Facts or Hype". The argument is getting hotter.

I wonder when it finally makes to court. What do you think?

One week before CPUGCON 2012

It is only one week before CPUG 2012 conference starts in Chur, Switzerland.

Three reasons to come:

1. lots of interesting discussions,
2. lots of interesting people and
3. lots of fun.

Are you coming or what???

GAiA tricks - mounting DVD

One more thing missing in GAiA is DVD/CD mount point. If you try to do mount /mnt/cdrom on GAiA, you get an error, because of the two reasons:

1. There is not mount point
2. fstab does not have corresponding info.

Let's make it work again.

1. Open fstab to edit with "vi /etc/fstab" and add there the following:

/dev/cdrom /mnt/cdrom udf,iso9660 noauto,owner,kudzu,ro 0 0

2. create /mnt/cdrom folder for using as a mount point: mkdir /mnt/cdrom

Now you are ready to mount your DVD or CD to the machine.

GAiA tricks - enabling sftp

GAiA is supposed to be more superior and generally better OS than SPLAT. In some aspects it is. But for someone used to work with SPLAT it may also be a hustle. A lot of things are done differently there. I am starting series of posts for GAiA tricks.

Today let's make SFTP work.

If you have ever tried SFTP with GAiA, it does not work for a very simple reason: it is disabled. To enable it, you have to do the following:

1. Create a new user for SFTP access with default bash shell. Alternatively change admin shell to bash. If you do not know how to do that, check chsh command.
2. Access Expert mode and open to edit sshd_config file: vi /etc/ssh/sshd_config
3. Uncomment the following string:
   #Subsystem sftp /usr/libexec/openssh/sftp-server
   and save the file.
4. Run /etc/init.d/sshd restart

Now enjoy SFTP working again.

Update: As Dameon D. Welch-Abernathy tells me on FB, there is SK for that: SK82281

Update 2: After some rather intensive discussion in one of LinkedIn groups, I have to make a clarification. SCP is working on GAiA same way it was with SPLAT. If you are using WinSCP client, it tries SFTP but falls back to SCP if there is a problem. That means, to transfer files with WinSCP client, you only need to perform step 1 from above. With WinSCP it is not so different from SPLAT.

But if you are not using Windows and/or want to run explicitly SFTP and not SCP, you still have to perform the whole procedure.