fw up_execute

Description

Executes the offline Unified Policy.

This command only supports:

Source IP address, Destination IP address, and objects that contain an IP address
Simple services objects (based on destination port, source port, and protocol)
Protocol detection
Application detection

These are not supported:

Implied rules
All other objects are not supported (Security Zone, Access Roles, Domain Objects, Updatable Objects, Dynamic Objects, Other/DCERPC service, Content awareness, VPN, Resource, Mobile Access Check Point Software Blade on a Security Gateway that provides a Remote Access VPN access for managed and unmanaged clients. Acronym: MAB. application, Time Objects, and so on)

Syntax

fw [-d] up_execute ipp=<IANA Protocol Number> [src=<Source IP>] [dst=<Destination IP>] [sport=<Source Port>] [dport=<Destination Port>] [protocol=<Protocol Detection Name>] [application=<Application/Category Name 1> [application=<Application/Category Name 2> ...]]

Parameters

Parameter

Description

No Parameters

Shows the built-in usage.

-d

Runs the command in debug mode.

Use only if you troubleshoot the command itself.

Best Practice - If you use this parameter, then redirect the output to a file, or use the script command to save the entire CLI session.

ipp=<IANA Protocol Number>

IANA Protocol Number in the Hexadecimal format.

Important - This parameter is always mandatory.

For example:

TCP = 6
UDP = 17
ICMP = 1

See IANA Protocol Numbers.

src=<Source IP>

Source IP address.

dst=<Destination IP>

Destination IP address.

sport=<Source Port>

Source Port number in the Decimal format.

See IANA Service Name and Port Number Registry.

dport=<Destination Port>

Destination Port number in the Decimal format.

Important - This parameter is mandatory for the TCP (6) and UDP (17) protocols.

See IANA Service Name and Port Number Registry.

protocol=<Protocol Detection Name>

Protocol detection name (HTTP, HTTPS, and so on).

application=<Application/Category Name>

Name of the Application/Category as defined in SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on..

You can specify multiple applications.

Example 1

[Expert@MyGW:0]# fw up_execute src=126.200.49.240 dst=10.1.1.1 ipp=1

Rulebase execution ended successfully.

Overall status:

----------------

Active clob mask: 0

Required clob mask: 0

Match status: MATCH

Match action: Accept

Per Layer:

------------

Layer name: Network

Layer id: 0

Match status: MATCH

Match action: Accept

Matched rule: 2

Possible rules: 2 16777215

[Expert@MyGW:0]#

Example 2

[Expert@MyGW:0]# fw up_execute src=10.1.1.1 ipp=6 dport=8080 protocol=HTTP application=Facebook application=Opera

Rulebase execution ended successfully.

Overall status:

----------------

Active clob mask: 0

Required clob mask: 0

Match status: MATCH

Match action: Accept

Per Layer:

------------

Layer name: Network

Layer id: 0

Match status: MATCH

Match action: Accept

Matched rule: 2

Possible rules: 2 16777215

[Expert@MyGW:0]#