fw sam_policy get

Description

The "fw sam_policy get and "fw6 sam_policy get" commands show all the configured Rate Limiting rules.

Also, see the "sam_alert" command in the R80.20 CLI Reference Guide.

Important:

This configuration is supported only from the Command Line.

You must run these commands in the Expert mode on one of the Security Group A logical group of Security Appliances that provides Active/Active cluster functionality. A Security Group can contain one or more Security Appliances. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway. Every Security Group contains: (A) Applicable Uplink ports, to which your production networks are connected; (B) Security Appliances (the Quantum Maestro Orchestrator determines the applicable Downlink ports automatically); (C) Applicable management port, to which the Check Point Management Server is connected. Members.
The Rate Limit configuration applies to each Security Group Member and not globally.
The Rate Limit configuration you make with these commands, survives reboot.
VSX Virtual System Extension. Check Point virtual networking solution, hosted on a computer or cluster with virtual abstractions of Check Point Security Gateways and other network devices. These Virtual Devices provide the same functionality as their physical counterparts. mode supports the Rate Limiting rules only from R80.20SP Jumbo Hotfix Accumulator Collection of hotfixes combined into a single package. Acronyms: JHA, JHF, JHFA. Take 266 (see MBS-4895 in sk155832).

In VSX mode, you must go to the context of an applicable Virtual System.
- In Gaia gClish The name of the global command line shell in Check Point Gaia operating system for Security Appliances connected to Check Point Quantum Maestro Orchestrators. Commands you run in this shell apply to all Security Appliances in the Security Group., run: set virtual-system <VSID>
- In the Expert mode, run: vsenv <VSID>
R80.20SP does not support the Suspicious Activity Monitoring (SAM) rules and the "fw sam" command (see 02641733 in sk113255 and in sk148074).

Notes:

These commands are interchangeable:
- For IPv4: "g_fw sam_policy" and "g_fw samp"
- For IPv6: "g_fw6 sam_policy" and "g_fw6 samp"
Security Group Members store the SAM Policy rules in the $FWDIR/database/sam_policy.db file.
Security Group Members store the SAM Policy management settings in the $FWDIR/database/sam_policy.mng file.

Best Practice - SAM Policy rules consume some CPU resources on Security Group Members. Set an expiration for rules that gives you time to investigate, but does not affect performance. Keep only the required SAM Policy rules. If you confirm that an activity is risky, edit the Security Policy Collection of rules that control network traffic and enforce organization guidelines for data protection and access to resources with packet inspection., educate users, or otherwise handle the risk.

Syntax for IPv4

g_fw [-d] sam_policy get [-l] [-u '<Rule UID>'] [-k '<Key>' -t <Type> [+{-v '<Value>'}] [-n]]

Syntax for IPv6

g_fw6 [-d] sam_policy get [-l] [-u '<Rule UID>'] [-k '<Key>' -t <Type> [+{-v '<Value>'}] [-n]]

Parameters

Note - All these parameters are optional.

Parameter

Description

-d

Runs the command in debug mode.

Use only if you troubleshoot the command itself.

Best Practice - If you use this parameter, then redirect the output to a file, or use the script command to save the entire CLI session.

-l

Controls how to print the rules:

In the default format (without "-l"), the output shows each rule Set of traffic parameters and other conditions in a Rule Base (Security Policy) that cause specified actions to be taken for a communication session. on a separate line.
In the list format (with "-l"), the output shows each parameter of a rule on a separate line.
See fw sam_policy add.

-u '<Rule UID>'

Prints the rule specified by its Rule UID or its zero-based rule index.

The quote marks and angle brackets ('<...>') are mandatory.

-k '<Key>'

Prints the rules with the specified predicate key.

The quote marks are mandatory.

-t <Type>

Prints the rules with the specified predicate type.

For Rate Limiting rules, you must always use "-t in".

+{-v '<Value>'}

Prints the rules with the specified predicate values.

The quote marks are mandatory.

-n

Negates the condition specified by these predicate parameters:

-k
-t
+-v

Examples

Example 4 - Printing rules that match the specified filters

[Expert@MyChassis-ch0x-0x:0]# g_fw samp get

no corresponding SAM policy requests

[Expert@MyChassis-ch0x-0x:0]#

[Expert@MyChassis-ch0x-0x:0]# g_fw samp add -a d -l r -t 3600 quota service any source range:172.16.7.11-172.16.7.13 new-conn-rate 5 flush true

[Expert@MyChassis-ch0x-0x:0]#

[Expert@MyChassis-ch0x-0x:0]# g_fw samp add -a n -l r quota service 1,50-51,6/443,17/53 service-negated true source cc:QQ byte-rate 0

[Expert@MyChassis-ch0x-0x:0]#

[Expert@MyChassis-ch0x-0x:0]# g_fw samp add -a b quota source range:172.16.8.17-172.16.9.121 service 6/80

[Expert@MyChassis-ch0x-0x:0]#

[Expert@MyChassis-ch0x-0x:0]# g_fw samp add -a d quota service any source-negated true source cc:QQ concurrent-conns-ratio 655 track source

[Expert@MyChassis-ch0x-0x:0]#

[Expert@MyChassis-ch0x-0x:0]# g_fw samp get

operation=add uid=<5bab3acf,00000000,3503a8c0,00003ddc> target=all timeout=indefinite action=drop service=any source-negated=true source=cc:QQ concurrent-conns-ratio=655 track=source req_type=quota

operation=add uid=<5bab3ac6,00000000,3503a8c0,00003dbf> target=all timeout=3586 action=drop log=log service=any source=range:172.16.7.11-172.16.7.13 new-conn-rate=5 flush=true req_type=quota

operation=add uid=<5bab3acc,00000000,3503a8c0,00003dd7> target=all timeout=indefinite action=bypass source=range:172.16.8.17-172.16.9.121 service=6/80 req_type=quota

operation=add uid=<5bab3ac9,00000000,3503a8c0,00003dd5> target=all timeout=indefinite action=notify log=log service=1,50-51,6/443,17/53 service-negated=true source=cc:QQ byte-rate=0 req_type=quota

[Expert@MyChassis-ch0x-0x:0]#

[Expert@MyChassis-ch0x-0x:0]# g_fw samp get -k 'service' -t in -v '6/80'

operation=add uid=<5bab3acc,00000000,3503a8c0,00003dd7> target=all timeout=indefinite action=bypass source=range:172.16.8.17-172.16.9.121 service=6/80 req_type=quota

[Expert@MyChassis-ch0x-0x:0]#

[Expert@MyChassis-ch0x-0x:0]# g_fw samp get -k 'service-negated' -t in -v 'true'

operation=add uid=<5bab3ac9,00000000,3503a8c0,00003dd5> target=all timeout=indefinite action=notify log=log service=1,50-51,6/443,17/53 service-negated=true source=cc:QQ byte-rate=0 req_type=quota

[Expert@MyChassis-ch0x-0x:0]#

[Expert@MyChassis-ch0x-0x:0]# g_fw samp get -k 'source' -t in -v 'cc:QQ'

operation=add uid=<5bab3acf,00000000,3503a8c0,00003ddc> target=all timeout=indefinite action=drop service=any source-negated=true source=cc:QQ concurrent-conns-ratio=655 track=source req_type=quota

operation=add uid=<5bab3ac9,00000000,3503a8c0,00003dd5> target=all timeout=indefinite action=notify log=log service=1,50-51,6/443,17/53 service-negated=true source=cc:QQ byte-rate=0 req_type=quota

[Expert@MyChassis-ch0x-0x:0]#

[Expert@MyChassis-ch0x-0x:0]# g_fw samp get -k source -t in -v 'cc:QQ' -n

operation=add uid=<5bab3ac6,00000000,3503a8c0,00003dbf> target=all timeout=3291 action=drop log=log service=any source=range:172.16.7.11-172.16.7.13 new-conn-rate=5 flush=true req_type=quota

operation=add uid=<5bab3acc,00000000,3503a8c0,00003dd7> target=all timeout=indefinite action=bypass source=range:172.16.8.17-172.16.9.121 service=6/80 req_type=quota

[Expert@MyChassis-ch0x-0x:0]#

[Expert@MyChassis-ch0x-0x:0]# g_fw samp get -k 'source-negated' -t in -v 'true'

operation=add uid=<5baa94e0,00000000,860318ac,00003016> target=all timeout=indefinite action=drop service=any source-negated=true source=cc:QQ concurrent-conns-ratio=655 track=source req_type=quota

[Expert@MyChassis-ch0x-0x:0]#

[Expert@MyChassis-ch0x-0x:0]# g_fw samp get -k 'byte-rate' -t in -v '0'

operation=add uid=<5baa9431,00000000,860318ac,00002efd> target=all timeout=indefinite action=notify log=log service=1,50-51,6/443,17/53 service-negated=true source=cc:QQ byte-rate=0 req_type=quota

[Expert@MyChassis-ch0x-0x:0]#

[Expert@MyChassis-ch0x-0x:0]# g_fw samp get -k 'flush' -t in -v 'true'

operation=add uid=<5baa9422,00000000,860318ac,00002eea> target=all timeout=2841 action=drop log=log service=any source=range:172.16.7.11-172.16.7.13 new-conn-rate=5 flush=true req_type=quota

[Expert@MyChassis-ch0x-0x:0]#

[Expert@MyChassis-ch0x-0x:0]# g_fw samp get -k 'concurrent-conns-ratio' -t in -v '655'

operation=add uid=<5baa94e0,00000000,860318ac,00003016> target=all timeout=indefinite action=drop service=any source-negated=true source=cc:QQ concurrent-conns-ratio=655 track=source req_type=quota

[Expert@MyChassis-ch0x-0x:0]#