Global Commands

The GaiaClosed Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. operating system includes a set of global commands that apply to all or specified Security GroupClosed A logical group of Security Appliances that provides Active/Active cluster functionality. A Security Group can contain one or more Security Appliances. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway. Every Security Group contains: (A) Applicable Uplink ports, to which your production networks are connected; (B) Security Appliances (the Quantum Maestro Orchestrator determines the applicable Downlink ports automatically); (C) Applicable management port, to which the Check Point Management Server is connected. Members in a Security Group.

Working with Global Commands

Background

Global Commands

Command

Description

auditlog

  • Enabled by default.

  • All commands are recorded in the audit log.

  • To learn more about the audit log, see Looking at the Audit Log.

config-lock

  • Protects the Gaia gClish database by locking it. Each Security Group Member has a single lock.

  • To set Gaia gClish operations for an Security Group Member, the Security Group Member must hold the config-lock.

  • To set config-lock, run:

    # set config-lock on override

  • Gaia gClish traffic runs on the Sync interface, TCP port 1129.

blade-range

  • Runs commands on specified Security Group Members.

  • Runs Gaia gClish embedded commands only on this subset of Security Group Members.

  • We do not recommend that you use the blade-range command, because all Security Group Members must have identical configurations.

Check Point Global Commands

These global commands apply to more than one Security Group Member. These global commands let you work with Security GatewayClosed Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. and SecureXLClosed Check Point product on a Security Gateway that accelerates IPv4 and IPv6 traffic that passes through a Security Gateway..

Description

The fw and fw6 commands are global scripts that run the fw and fw6 commands on each Security Group Member.

Below are some examples:

[Expert@MyChassis-ch01-01:0]# gclish
[Global] MyChassis-ch01-01> fw ctl
-*- 2 blades: 1_01 1_02 -*-
 Usage: fw ctl command args...
 Commands: install, uninstall, pstat, iflist, arp, debug, kdebug, bench
    chain, conn, multik, conntab, fwghtab_bl_stats
>
 
[Expert@MyChassis-ch01-01:0]# gclish
[Global] MyChassis-ch01-01> fw ctl iflist
-*- 6 blades: 1_01 1_02 1_03 2_01 2_02 2_03 -*-
0 : BPEth0
1 : BPEth1
2 : eth1-Mgmt4
3 : eth2-Mgmt4
4 : eth1-01
5 : eth1-CIN
6 : eth2-CIN
8 : eth2-01
16 : Sync
17 : eth1-Mgmt1
18 : eth2-Mgmt1
>

Description

Use the fw dbgfile commands in Gaia gClish to debug the system.

Syntax to collect the debug

> fw dbgfile collect -f <debug_file_path> [-buf <buf_size>] [-m <debug_module_1> <debug_flags_1> [-m <debug_module_2> <debug_flags_2>] ... [-m <debug_module_N> <debug_flags_N>]]

Syntax to show the collected debug

> fw dbgfile view [<debug_file_path>] [-o <agg_file_path>]

Parameters

Parameter

Description

collect

Collects the Security Gateway debug information.

view

Shows the collected debug information.

<debug_file_path>

Specifies the full path of the debug file.

-buf <buf_size>

Specifies the debug buffer size.

Always set the maximal size 8200.

-m <debug_module_1>
<debug_flags_1>
[-m <debug_module_2>
<debug_flags_2>]
...
[-m <debug_module_N>
<debug_flags_N>]

Specifies Security Gateway debug modules and debug flags in those modules.

You can specify more than one debug module.

-o <agg_file_path>

Uses an aggregate debug file.

<agg_file_path> - Full path of the aggregate debug file.

Below are some examples:

> fw dbgfile collect -f /var/log/debug.txt -buf 8200 -m fw + conn -m kiss + pmdump

> fw dbgfile view /var/log/debug.txt

Important - For complete debug procedure, see the R80.30SP Quantum Maestro Security Gateway Guide - Chapter Kernel Debug on Security Groups.

Description

The fwaccel commands control the acceleration for IPv4 traffic.

The fwaccel6 commands control the acceleration for IPv6 traffic.

When you run the fwaccel and fwaccel6 commands in Gaia gClish, they show combined information from all Security Group Members, for most parameters.

Syntax for IPv4

fwaccel help

Syntax for IPv6

fwaccel6 help

Parameters and Options

For more information, see the R80.30SP Quantum Maestro Performance Tuning Administration Guide - Chapter SecureXL - Section SecureXL Commands - Subsection 'fwaccel' and 'fwaccel6'.

General Global Commands

Global commands apply to more than one Security Group Member.

See the syntax of the global commands in Global Operating System Commands.

These commands are available in Gaia Clish and Gaia gClish:

In Gaia Clish and Gaia gClish

In the Expert mode

update_conf_file

g_update_conf_file

global

global_help

asg_cp2blades

asg_cp2blades

asg_clear_table

asg_clear_table

Below are some global commands

Description

The global help command in Gaia gClish shows the list of global commands you can use in Gaia gClish and how they are generally used.

Syntax

> global help

Below are some examples:

[Expert@MyChassis-ch01-01:0]# gclish
[Global] MyChassis-ch01-01> global help
Usage: <command_name> [-b SGMs] [-a -l -r --] <native command arguments>
Executes the specified command on specified blades.
 
Optional Arguments:
  -b   blades: in one of the following formats
              1_1,1_4 or 1_1-1_4 or 1_01,1_03-1_08,1_10
              all (default)
              chassis1
              chassis2
              chassis_active
  -a        : Force execution on all SGMs (incl. down SGMs).
  -l        : Execute only on local blade.
  -r        : Execute only on remote SGMs.
 

Command list:

snapshot_show_current snapshot_recover fwaccel6_m fwaccel6 fw6 unlock update_conf_file mv fwaccel_m ethtool md5sum dmesg cp tcpdump cat tail clusterXL_admin reboot ls fwaccel vpn fw netstat cpstop cpstart cplic asg

[Global] MyChassis-ch01-01> 

[Expert@MyChassis-ch01-01:0]# gclish
[Global] MyChassis-ch01-01> global help
Usage: <command_name> [-b SGMs] [-a -l -r --] <native command arguments>
Executes the specified command on specified blades.
 
Optional Arguments:
  -b   blades: in one of the following formats
              1_1,1_4 or 1_1-1_4 or 1_01,1_03-1_08,1_10
              all (default)
              chassis1
              chassis2
              chassis_active
  -a        : Force execution on all SGMs (incl. down SGMs).
  -l        : Execute only on local blade.
  -r        : Execute only on remote SGMs.
 

Command list:

cplic cpstart cpstop netstat fw vpn fwaccel ls reboot clusterXL_admin tail cat tcpdump cp dmesg md5sum ethtool fwaccel_m mv update_conf_file unlock fwaccel6_m snapshot_recover snapshot_show_current asg

[Global] MyChassis-ch01-01>

Description

Use the update_conf_file command in Gaia gClish or the g_update_conf_file command in the Expert mode to add, update, and remove variables from configuration files.

Important - After you change the configuration files, you must reboot all Security Group Members..

Syntax

update_conf_file <file_name> <variable>=<value>

g_update_conf_file <file_name> <variable>=<value>

Parameters

Parameter

Description

<file_name>

Full path and name of the configuration file to update

You do not need to specify the full path for these files (only specify the file name):

  • $FWDIR/boot/modules/fwkern.conf

  • $PPKDIR/conf/simkern.conf

<variable>

Name of the variable to update

<value>

New value for the variable

 
[Expert@MyChassis-ch01-01:0]# gclish
[Global] MyChassis-ch01-01>
[Global] MyChassis-ch01-01> update_conf_file /home/admin/MyConfFile.txt var1=hello
[Global] MyChassis-ch01-01>
[Global] MyChassis-ch01-01> cat /home/admin/MyConfFile.txt
-*- 3 blades: 2_01 2_02 2_03 -*-
var1=hello
 
[Global] MyChassis-ch01-01> update_conf_file /home/admin/MyConfFile.txt var2=24h
[Global] MyChassis-ch01-01> 
[Global] MyChassis-ch01-01> cat /home/admin/MyConfFile.txt
-*- 3 blades: 2_01 2_02 2_03 -*-
var2=24h
var1=hello
 
[Global] MyChassis-ch01-01> update_conf_file /home/admin/MyConfFile.txt var1=goodbye
[Global] MyChassis-ch01-01> 
[Global] MyChassis-ch01-01> cat /home/admin/MyConfFile.txt
-*- 3 blades: 2_01 2_02 2_03 -*-
var2=24h
var1=goodbye
 
[Global] MyChassis-ch01-01> update_conf_file /home/admin/MyConfFile.txt var2=
[Global] MyChassis-ch01-01>
[Global] MyChassis-ch01-01> cat /home/admin/MyConfFile.txt
-*- 3 blades: 2_01 2_02 2_03 -*-
var1=goodbye
[Global] MyChassis-ch01-01>

Notes:

  • This command works with configuration files in a specified format. It is composed of lines where each line defines one variable:

    <variable>=<value>

    The $FWDIR/boot/modules/fwkern.conf and $PPKDIR/conf/simkern.conf files use this format.

  • Variable name must not include an equal sign (=).

  • If the specified configuration file does not exist, this command creates it.

  • This command makes the required changes on all Security Group Members.

    It is not necessary to copy the updated file to other Security Group Members with the "asg_cp2blades" command.

Description

Use these commands in the Expert mode to set or show specified Firewall kernel parameters.

Syntax for viewing the current value of a variable

# g_fw ctl get <type> <parameter_name>

Syntax for setting a value of a variable

# g_fw ctl set <type> <parameter_name> <value>

Parameters

Parameter

Description

get

Shows the specified parameter and its value.

set

Change the parameter value to the specified value.

<type>

Type of parameter value:

  • int - Integer value

  • str - String value

Note - You must enter the correct parameter type.

<parameter_name>

Parameter name.

<value>

Parameter value.

Note - To make changes persistent, you must manually add the applicable kernel parameters and their values in the $FWDIR/boot/modules/fwkern.conf. Use the g_update_conf_file command in the Expert mode. See Updating Configuration Files (update_conf_file).

For more information, see the R80.30SP Quantum Maestro Security Gateway Guide - Chapter Working with Kernel Parameters on Security Groups.

Description

Use the asg_cp2blades command in Gaia gClish or the Expert mode to copy files from the current Security Group Member to other Security Group Members.

Syntax

asg_cp2blades [-b <SGM_IDs>] [-s] <source_path> [<dest_path>]

Parameters

Parameter

Description

-b <SGM_IDs>

Applies to Security Group Members as specified by <SGM_IDs>.

<SGM_IDs> can be:

  • No <SGM_IDs > specified, or all - Applies to all Security Group Members and Sites

  • One Security Group Member (for example, 1_1)

  • A comma-separated list of Security Group Members (for example, 1_1,1_4)

  • A range of Security Group Members (for example, 1_1-1_4)

  • In Dual Site, one Site (chassis1, or chassis2)

  • In Dual Site, the Active Site (chassis_active)

-r

Copy folders and directories that contain files.

-s

Save a local copy of the old file on each Security Group Member

The copy is saved in the same directory as the new file.

The old file has the same name with this at the end:

*.bak.<date>.<time>

<source_path>

Full path and name of the file to copy

<dest_path>

Full path of the destination

If not specified, the command copies the file to the relative source file location.

 
[Expert@MyChassis-ch01-01:0]# gclish
[Global] MyChassis-ch01-01 > asg_cp2blades /home/admin/note.txt
Operation completed successfully
[Global] MyChassis-ch01-01 >
[Global] MyChassis-ch01-01 > cat /home/admin/note.txt
-*- 3 blades: 2_01 2_02 2_03 -*-
hello world
[Global] MyChassis-ch01-01>

Description

Description

Use the asg_clear_table command in Gaia gClish or the Expert mode to delete connections from the Security Gateway Connections table.

The command runs up to 15 times, or until there are less than 50 connections left.

Note - If you are connected to the machine with SSH, your connection is disconnected.

Syntax

asg_clear_table [-b <SGM_IDs>]

Parameters

Parameter

Description

-b <SGM_IDs>

Applies to Security Group Members as specified by <SGM_IDs>.

<SGM_IDs> can be:

  • No <SGM_IDs > specified, or all - Applies to all Security Group Members and Sites

  • One Security Group Member (for example, 1_1)

  • A comma-separated list of Security Group Members (for example, 1_1,1_4)

  • A range of Security Group Members (for example, 1_1-1_4)

  • In Dual Site, one Site (chassis1, or chassis2)

  • In Dual Site, the Active Site (chassis_active)

Note - With this option, you can only select Security Group Members from one Site.

Description

Use the show interface command in Gaia gClish to view information about the interfaces on the Security Group Members.

For more information, see the R80.30SP Quantum Maestro Gaia Administration Guide - Chapter Network Management - Section Network Interfaces.

Syntax

> show interfaces all

> show interface <options> 

[Expert@MyChassis-ch01-01:0]# gclish
[Global] MyChassis-ch01-01> show interface eth1-01 ipv4-address
1_01:
ipv4-address 4.4.4.10/24
 
1_02:
ipv4-address 4.4.4.10/24
 
1_03:
ipv4-address 4.4.4.10/24
 
1_04:
ipv4-address 4.4.4.10/24
 
1_05:
Blade 1_05 is down. See "/var/log/messages".
 
2_01:
ipv4-address 4.4.4.10/24
 
2_02:
ipv4-address 4.4.4.10/24
 
2_03:
ipv4-address 4.4.4.10/24
 
2_04:
ipv4-address 4.4.4.10/24
 
2_05:
ipv4-address 4.4.4.10/24
[Global] MyChassis-ch01-01>