SecureXL Debug Procedure

By default, SecureXL Check Point product on a Security Gateway that accelerates IPv4 and IPv6 traffic that passes through a Security Gateway. writes the output debug information to the /var/log/messages file.

To collect the applicable SecureXL debug and to make its analysis easier, follow the steps below.

Note - For the complete debug procedure, see the R81.20 Quantum Security Gateway Guide - Chapter "Kernel Debug".

Important:

We strongly recommend to schedule a full maintenance window to minimize the impact on your production traffic.
We strongly recommend to connect over serial console to your Security Gateway Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. / each Cluster Member Security Gateway that is part of a cluster. / Scalable Platform Security Group Members.

This is to prevent a possible issue when you cannot work with the CLI because of a high load on the CPU.
In cluster Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing., you must collect this debug from all Cluster Members in the same way.
Debug the specific SecureXL instance only when you are sure that only that SecureXL instance processes the traffic.

Procedure

Configure the applicable kernel debug modules and kernel debug flags

On the Security Gateway / each Cluster Member, run:

fw ctl debug -m <Name of Kernel Debug Module> {all | + <Kernel Debug Flags>}

On the Scalable Platform Security Group, run:

g_fw ctl debug -m <Name of Kernel Debug Module> {all | + <Kernel Debug Flags>}

Configure the applicable SecureXL debug modules and SecureXL debug flags

On the Security Gateway / each Cluster Member:

fwaccel dbg -m <Name of SecureXL Debug Module> {all | + <SecureXL Debug Flags>}

On the Scalable Platform Security Group:

g_fwaccel dbg -m <Name of SecureXL Debug Module> {all | + <SecureXL Debug Flags>}

See SecureXL Debug Modules and Debug Flags.

Remove all entries from both the Firewall Connections table and SecureXL Connections table

Important:

This step makes sure that you collect the debug of the real issue that is not affected by the existing connections.
This command deletes all existing connections. This interrupts all connections, including the SSH.

Run this command only if you are connected over a serial console to your Security Gateway / each Cluster Member / Scalable Platform Security Group Members.

On the Security Gateway / each Cluster Member, run:

fw tab -t connections -x -y

On the Scalable Platform Security Group, run:

g_fw tab -t connections -x -y

Remove all entries from the Firewall Templates table

Note - This command does not interrupt the existing connections. This step makes sure that you collect the debug of the real issue that is not affected by the existing connection templates.

On the Security Gateway / each Cluster Member, run:

fw tab -t cphwd_tmpl -x -y

On the Scalable Platform Security Group, run:

g_fw tab -t cphwd_tmpl -x -y

Start the kernel debug

In Gateway mode:

On the Security Gateway / each Cluster Member, run:

fw ctl kdebug -T -f -o /var/log/kernel_debug.txt

On the Scalable Platform Security Group, run:

g_fw ctl kdebug -T -f -o /var/log/kernel_debug.txt

In VSX mode - for specific Virtual Systems:

On the VSX Gateway / each VSX Cluster Member, run:

fw ctl kdebug -v {"<List of VSIDs>" | all} -k -T -f -o /var/log/kernel_debug.txt

On the Scalable Platform Security Group in VSX mode, run:

g_fw ctl kdebug -v {"<List of VSIDs>" | all} -k -T -f -o /var/log/kernel_debug.txt

Replicate the issue, or wait for the issue to occur

Perform the steps that cause the issue to occur, or wait for it to occur.
Stop the kernel debug

Press CTRL+C.

Analyze the debug output files

Transfer these files from the Security Gateway / each Cluster Member / each Security Group Member to your computer:

/var/log/kernel_debug.txt

/var/log/messages*

$FWDIR/log/fwk.elg*

/var/log/usim_x86.elg*

Best Practice - Compress these files with the "tar -zxvf" command and transfer the archive from the Security Gateway / each Cluster Member / each Security Group Member to your computer. If you transfer to an FTP server, do so in the binary mode.