SPLAT WebUI port customization with R75

One of my favorite commands on SPLAT is webui. It allows you to set WEbUI on a custom port, if you like. For example, to set it on port 4434 you just need to run the following: webui enable 4434

But be careful, with R75 and up the behavior has been changed. Even if you set it up on a custom port as described above, it will get back to default 443 after reboot.

This is quite annoying, especially if you have Mobile Access Blade with SSL portal running on your GW. But no worries, there is another place, rather unusual, where you can set it up right.

For your R75 and R75.X objects, go to SmartDashboard, then double click to the managed object and choose SecurePlatform tab.

In the "Main URL" field add your port, as shown on the picture above. Push policy, now it is all good.

ClusterXL flapping troubleshooting - short HOWTO

ClusterXL is one of the most interesting and yet not easy to handle parts of the Check Point products. This post is to summarize some basic troubleshooting steps when dealing with cluster instability.

Symptops: FW SPLAT based cluster is "flapping". Members periodically change status from Active/Standby to Down. In SmartView Tracker logs you can see entries about "member 1 is down" members 2 changes state to active" as well as messages of connectivity problems with cluster interfaces:


cluster_info: (ClusterXL) member 2 (192.168.0.6) is down (Interface Active Check on member 2 (192.168.0.6) detected a problem (14 interfaces required, only 13 up).)
cluster_info: (ClusterXL) interface Mgmt of member 2 (192.168.0.6) is down (receive up, transmit down) 


------------------------------------------------------------


There are some basic steps for fixing it quickly.

1. Check if there is any other Check Point cluster connected to the same IP network. If there is, change so-called "magic MAC" numbers, as described in SK25977. Aplly the solution, reboot the cluster. Check if the issue is now fixed. If not, go to the step 2.


2. Check your cluster is runnign in multicast mode. To do that, run

# cphaprob -a if
You should have something to the following output:


------------------------
High Availability interfaces (cphaprob -a if)
------------------------
Required interfaces: 4
Required secured interfaces: 1


eth0       UP                    non sync(non secured), multicast
eth1       UP                    sync(secured), multicast
eth2       UP                    non sync(non secured), multicast
eth3       UP                    non sync(non secured), multicast


If you have broadcast for interfaces instead of multicast, there is something wrong with physical interfaces, cabling and switching. Otherwise to to the step 3.

3. Be sure IGMP snooping is disabled on the adjacent switch. ClusterXL uses CCP in multicast mode by default, so IGMP registration won't work on the switch side. You have to have IGMP snooping disabled globally on the switch or at least for the specific NIC ports connected to the cluster.

Once IGMP snooping is disabled, this should stop flapping. Reasons are mentioned in ClusterXL R75.20 Administration Guide on the page 31.

In case you cannot disable IGMP snooping on the switch, the last option is to switch CCP from multicast to broadcast.

To do that, run

cphaconf set_ccp broadcast  

You will have to reboot the cluster again.  As mentioned in the comments, reboot is not required to activate the feature.


All, if you have something to add to this, please be my guest and comment at will.

The qurious case of CCMA certification

Last year I have mentioned CCMA certification twice: in January and in May.

The first post was about CCMSE to be a new per-requisite for CCMA certification.  Later that year I had to make a second post about CCMSE being just a recommendation and not a requirement for CCMA.

It would be unwise to think the story has ended there. Behold,

CCMSE is back. You have to certify both MDM and VSX to be able to continue to CCMA path.

Dear Check Point. Please make up your mind and stick to it.

Sincerely yours,..


----
P.S. Just after I posted this I have found a great post from Danny Jung: CCMA's diary. That's a great one, take a look.

Check Point Price List is no longer public

I was (not exactly pleasantly) surprised this morning to find out Check Point Price list access now requires valid User Center account.

Japanese part is still in public zone, but not the regular price list. Not anymore.

I do know it takes only 2 minutes to set up a new account to access price list. In my personal case I use partner quote tools for years.

But what about any new and/or potential customers, Check Point? Why should you have to limit access to the major reference tool?

What's the point?

3D Reporting tool, quick HOWTO and tips

As I have mentioned recently, Check Point has release so called 3D Analysis tool to help partner in showing added values of Check Point technologies by analyzing live production traffic.

Although this tool is a great thing, there are some tips and tricks to make it work even better:

1. Licensing. The downloadable tool from Check Point has an expired license. Use your quick eval license on it.
2. Tapping. The official guide mentions tapping on the external interface of the cusotmer's FW. In this case bandwidth utilization will not show internal hosts. Identity Awareness information will also be unavailable. You may want to mirror the internal interface of the customer FW, in case topology in place is simple.
3. DLP policy is not set to customer's case. Do not forget to configure email domain properly before deploying the tool.
4. identity Awareness is not activated. If you want to enable it, mind p.2. Also do not forget to arrange connectivity to AD from the physical machine hosting 3D VM tool.
5. Policy installation. VM does not have any policy installed when you start it, do not forget this tiny detail.

If you have some other tips, please kindly share them in the comments.

CPX 2012 Europe

Have you seen Check Point Experience 2012 is to take place in Berlin on May, 30-31?

Are you coming?

Gaia public EA, first impression

As you may already know, long expected Check Point Gaia has finally made the first public EA.

I am currently playing with it, and it seems quite interesting. Here are my first notes for the matter.

Finally, Google Chrome is support for WebUI, although my old Firefox 3.6 on OSX is not. The first time wizard loos quite nice, and it finally recognizes the platform, VMware Fusion in my case.

VRRP is indeed part of the release, all praise Check Point for that!

When installing, you can see much more detailed progress

Once system is up, you get WebUI overview page. It is too big to put it here, but there are some detais I would like to point out. There is a feedback area in the GUI. You can just mark something you like or not with the smiley faces, You can also send the text feedback form the tool.

 Check Point listens, isn't it nice?

One last picture for today, in the use management section one is able to set a lot of accessibility and management roles. Each part of MGMT interface can be set to full rights or read only.

Now, what about kernel? It is still RH Linux based, 2.6 version. I have installed 64 Bit version, and it seems to do its job so far.

CLI is set to clish, and you get bash in expert mode. cpshell is still there, but some of the commands do not work. As I am still in the earliest curiosity stage, RTFM step is not done yet, so it might be a user error.

I am planning to dig into the most expected features: dynamic routing, VRRP, extended kernel memory, etc. New posts to come.