Global Commands

The Gaia operating system includes a set of global commands that apply to all or specified Security Group Members.

Working with Global Commands

Background

  • Gaia gClish commands apply globally to all Security Group Members, by default.

  • Gaia gClish commands do not apply to Security Group Members that are in the DOWN state in the Security Group.

    If you run a "set" command while a Security Group Member is in the DOWN state, the command does not update that Security Group Member.

    The Security Group Member synchronizes its database during startup and applies the changes after reboot.

  • Gaia Clish commands apply only to the specific Security Group Member.

    For these commands, see the R81.20 Gaia Administration Guide.

Global Commands

Command

Instructions

auditlog

  • Enabled by default.

  • All commands are recorded in the audit log.

  • To learn more about the audit log, see Looking at the Audit Log.

config-lock

  • Protects the Gaia gClish database by locking it. Each Security Group Member has one lock.

  • To set Gaia gClish operations for an Security Group Member, the Security Group Member must hold the "config-lock".

  • To set the "config-lock", run:

    set config-lock on override

  • Gaia gClish traffic runs on the Sync interface, TCP port 1129.

blade-range

  • Runs commands on specified Security Group Members.

  • Runs Gaia gClish embedded commands only on this subset of Security Group Members.

  • We do not recommend that you use the blade-range command, because all Security Group Members must have identical configurations.

Check Point Global Commands

These global commands apply to more than one Security Group Member. These global commands let you work with Security Gateway and SecureXL.

Description

The fw and fw6 commands are global scripts that run the fw and fw6 commands on each Security Group Member.

Syntax

Shell

Syntax

Gaia Clish

Gaia gClish

fw

fw6

Expert mode

g_fw

g_fw6

Examples

[Expert@HostName-ch0x-0x:0]# gclish
[Global] HostName-ch01-01> fw ctl
-*- 2 blades: 1_01 1_02 -*-
 Usage: fw ctl command args...
 Commands: install, uninstall, pstat, iflist, arp, debug, kdebug, bench
    chain, conn, multik, conntab, fwghtab_bl_stats
[Global] HostName-ch01-01 >
 
[Expert@HostName-ch0x-0x:0]# gclish
[Global] HostName-ch01-01> fw ctl iflist
-*- 6 blades: 1_01 1_02 1_03 2_01 2_02 2_03 -*-
0 : BPEth0
1 : BPEth1
2 : eth1-Mgmt4
3 : eth2-Mgmt4
4 : eth1-01
5 : eth1-CIN
6 : eth2-CIN
8 : eth2-01
16 : Sync
17 : eth1-Mgmt1
18 : eth2-Mgmt1
[Global] HostName-ch01-01 >

Description

Use the "fw dbgfile" commands in Gaia gClish to debug how the Security Group inspect traffic.

Syntax to collect the debug

fw dbgfile collect -f <Debug Output File> [-buf <Buffer Size>] [-m <Debug Module 1> <Debug Flags 1> [-m <Debug Module 2> <Debug Flags 2>] ... [-m <Debug Module N> <Debug Flags N>]]

Syntax to show the collected debug

fw dbgfile view [<Debug Output File>] [-o <Debug Output File>]

Parameters

Parameter

Description

collect

Collects the Security Gateway debug information.

view

Shows the collected debug information.

<Debug Output File>

Specifies the full path and the name of the debug output file.

-buf <Buffer Size>

Specifies the debug buffer size.

Always set the maximal size 8200.

-m <Debug Module 1> Debug Flags 1>
[-m <Debug Module 2> <Debug Flags 2>]
...
[-m <Debug Module N> <Debug Flags N>]

Specifies Security Gateway debug modules and debug flags in those modules.

You can specify more than one debug module.

-o <Debug Output File>

Specifies the full path and the name of the debug output file to read.

Examples

[Global] HostName-ch01-01 > fw dbgfile collect -f /var/log/debug.txt -buf 8200 -m fw + conn -m kiss + pmdump

[Global] HostName-ch01-01 > fw dbgfile view /var/log/debug.txt

Important - For complete debug procedure, see the R81.20 Quantum Security Gateway Guide > Chapter Kernel Debug on Security Groups.

Description

The fwaccel commands control the acceleration for IPv4 traffic.

The fwaccel6 commands control the acceleration for IPv6 traffic.

Syntax

Shell

Syntax for IPv4

Syntax for IPv6

Gaia Clish

Gaia gClish

fwaccel help

fwaccel6 help

Expert mode

g_fwaccel help

g_fwaccel6 help

Parameters and Options

For more information, see the R81.20 Performance Tuning Administration Guide > Chapter SecureXL > Section SecureXL Commands and Debug - Subsection 'fwaccel' and 'fwaccel6'.

General Global Commands

Global commands apply to more than one Security Group Member.

These commands are available in Gaia Clish and Gaia gClish:

In Gaia Clish and Gaia gClish

In the Expert mode

update_conf_file

g_update_conf_file

global

global_help

asg_cp2blades

asg_cp2blades

asg_clear_table

asg_clear_table

Below are some global commands

Description

Use the "global help" command in Gaia gClish to show the list of global commands you can use in Gaia gClish.

Syntax

global help

Examples

[Expert@HostName-ch0x-0x:0]# gclish
[Global] HostName-ch01-01> global help
Usage: <command_name> [-b SGMs] [-a -l -r --] <native command arguments>
Executes the specified command on specified blades.
 
Optional Arguments:
  -b   blades: in one of the following formats
              1_1,1_4 or 1_1-1_4 or 1_01,1_03-1_08,1_10
              all (default)
              chassis1
              chassis2
              chassis_active
  -a        : Force execution on all SGMs (incl. down SGMs).
  -l        : Execute only on local blade.
  -r        : Execute only on remote SGMs.
 

Command list:

snapshot_show_current snapshot_recover fwaccel6_m fwaccel6 fw6 unlock update_conf_file mv fwaccel_m ethtool md5sum dmesg cp tcpdump cat tail clusterXL_admin reboot ls fwaccel vpn fw netstat cpstop cpstart cplic asg

[Global] HostName-ch01-01> 

[Expert@HostName-ch0x-0x:0]# gclish
[Global] HostName-ch01-01> global help
Usage: <command_name> [-b SGMs] [-a -l -r --] <native command arguments>
Executes the specified command on specified blades.
 
Optional Arguments:
  -b   blades: in one of the following formats
              1_1,1_4 or 1_1-1_4 or 1_01,1_03-1_08,1_10
              all (default)
              chassis1
              chassis2
              chassis_active
  -a        : Force execution on all SGMs (incl. down SGMs).
  -l        : Execute only on local blade.
  -r        : Execute only on remote SGMs.
 

Command list:

cplic cpstart cpstop netstat fw vpn fwaccel ls reboot clusterXL_admin tail cat tcpdump cp dmesg md5sum ethtool fwaccel_m mv update_conf_file unlock fwaccel6_m snapshot_recover snapshot_show_current asg

[Global] HostName-ch01-01>

Description

Use these commands to add, update, and remove parameters in configuration files.

Important - After you change the configuration files, you must reboot the Security Group with the "reboot -b all" command.

Syntax

Shell

Syntax

Gaia gClish

update_conf_file <File Name> <Parameter Name>=<Parameter Value>

Expert mode

g_update_conf_file <File Name> <Parameter Name>=<Parameter Value>

Important:

  • There must not be a space in front of the equal sign (=).

  • There must not be a space after the equal sign (=).

Parameters

Parameter

Description

<File Name>

Full path and name of the configuration file to update

You do not need to specify the full path for these files (only specify the file name):

  • $FWDIR/boot/modules/fwkern.conf

  • $PPKDIR/conf/simkern.conf

<Parameter Name>

Name of the parameter to configure.

<Parameter Value>

New value for the parameter to configure.

Notes:

  • These commands work with configuration files in a specified format.

    It is composed of lines, where each line defines one parameter:

    <Parameter Name>=<Parameter Value>

    The $FWDIR/boot/modules/fwkern.conf and $PPKDIR/conf/simkern.conf files use this format.

  • If the specified configuration file does not exist, these commands create it.

  • These commands make the required changes on all Security Group Members.

    It is not necessary to copy the updated file to other Security Group Members with the "asg_cp2blades" command.

 
[Expert@HostName-ch0x-0x:0]# gclish
[Global] HostName-ch01-01>
[Global] HostName-ch01-01> update_conf_file /home/admin/MyConfFile.txt var1=hello
[Global] HostName-ch01-01>
[Global] HostName-ch01-01> cat /home/admin/MyConfFile.txt
-*- 3 blades: 2_01 2_02 2_03 -*-
var1=hello
 
[Global] HostName-ch01-01> update_conf_file /home/admin/MyConfFile.txt var2=24h
[Global] HostName-ch01-01> 
[Global] HostName-ch01-01> cat /home/admin/MyConfFile.txt
-*- 3 blades: 2_01 2_02 2_03 -*-
var2=24h
var1=hello
 
[Global] HostName-ch01-01> update_conf_file /home/admin/MyConfFile.txt var1=goodbye
[Global] HostName-ch01-01> 
[Global] HostName-ch01-01> cat /home/admin/MyConfFile.txt
-*- 3 blades: 2_01 2_02 2_03 -*-
var2=24h
var1=goodbye
 
[Global] HostName-ch01-01> update_conf_file /home/admin/MyConfFile.txt var2=
[Global] HostName-ch01-01>
[Global] HostName-ch01-01> cat /home/admin/MyConfFile.txt
-*- 3 blades: 2_01 2_02 2_03 -*-
var1=goodbye
[Global] HostName-ch01-01>

Description

Use these commands in the Expert mode to show or set the values of the specified Firewall kernel parameters.

Syntax for viewing the current value of a kernel parameter

g_fw ctl get <Parameter Type> <Parameter Name>

Syntax for setting a value of a kernel parameter

g_fw ctl set <Parameter Type> <Parameter Name> <Parameter Value>

Parameters

Parameter

Description

get

Shows the specified parameter and its value.

set

Change the parameter value to the specified value.

<Parameter Type>

Type of the parameter:

  • int - Accepts integer values

  • str - Accepts string values

Note - You must enter the correct parameter type.

<Parameter Name>

Parameter name to configure.

<Parameter Value>

Parameter value to configure.

Note - To make changes persistent, you must manually add the applicable kernel parameters and their values in the $FWDIR/boot/modules/fwkern.conf file.

Use the "g_update_conf_file" command in the Expert mode.

See Updating Configuration Files (update_conf_file).

For more information, see the R81.20 Quantum Security Gateway Guide > Chapter Working with Kernel Parameters on Security Groups.

Description

Use the "asg_cp2blades" command in Gaia gClish or the Expert mode to copy files from the current Security Group Member to another Security Group Member.

Syntax (for Gaia gClish and the Expert mode)

asg_cp2blades [-b <SGM IDs>] [-s] <Source Path> [<Destination Path>]

Parameters

Parameter

Description

-b <SGM IDs>

Applies to Security Group Members as specified by the <SGM IDs>.

<SGM IDs> can be:

  • No <SGM IDs> specified, or all

    Applies to all Security Group Members and all Maestro Sites

  • One Security Group Member (for example, 1_1)

-r

Copy folders and directories that contain files.

-s

Save a local copy of the old file on each Security Group Member.

The copy is saved in the same directory as the new file.

The old file has the same name with this at the end:

*.bak.<date>.<time>

<Source Path>

Full path and name of the file to copy.

<Destination Path>

Full path of the destination.

If not specified, the command copies the file to the relative source file location.

 
[Expert@HostName-ch0x-0x:0]# gclish
[Global] HostName-ch01-01 > asg_cp2blades /home/admin/note.txt
Operation completed successfully
[Global] HostName-ch01-01 >
[Global] HostName-ch01-01 > cat /home/admin/note.txt
-*- 3 blades: 2_01 2_02 2_03 -*-
hello world
[Global] HostName-ch01-01>

Description

Use the "asg_clear_table" command in Gaia gClish or the Expert mode to delete connections from the Connections table on the Security Group Members.

The command runs up to 15 times, or until there are less than 50 connections left.

Important - If you are connected to the Security Group over SSH, your connection is disconnected.

Syntax (for Gaia gClish and the Expert mode)

asg_clear_table [-b <SGM IDs>]

Parameters

Parameter

Description

-b <SGM IDs>

Applies to Security Group Members as specified by the <SGM IDs>.

<SGM IDs> can be:

  • No <SGM IDs> specified, or all

    Applies to all Security Group Members and all Maestro Sites

  • One Security Group Member (for example, 1_1)

Note - With this option, you can only select Security Group Members from one Site.

Description

Use the "show interface" command in Gaia gClish to view information about the interfaces on the Security Group Members.

For more information, see the R81.20 Gaia Administration Guide > Chapter Network Management > Section Network Interfaces.

Syntax

show interfaces all

show interface <Options> 

[Expert@HostName-ch0x-0x:0]# gclish
[Global] HostName-ch01-01> show interface eth1-01 ipv4-address
1_01:
ipv4-address 4.4.4.10/24
 
1_02:
ipv4-address 4.4.4.10/24
 
1_03:
ipv4-address 4.4.4.10/24
 
1_04:
ipv4-address 4.4.4.10/24
 
1_05:
Blade 1_05 is down. See "/var/log/messages".
 
2_01:
ipv4-address 4.4.4.10/24
 
2_02:
ipv4-address 4.4.4.10/24
 
2_03:
ipv4-address 4.4.4.10/24
 
2_04:
ipv4-address 4.4.4.10/24
 
2_05:
ipv4-address 4.4.4.10/24
[Global] HostName-ch01-01>

Global Operating System Commands

Global operating system commands are standard Linux commands that run on all or specified Security Group Members.

When you run a global command in Gaia gClish, the operating system runs a global script that is the standard Linux command on the Security Group Members.

When you run a command in the Expert mode, it works as a standard Linux command.

To use the global command in the Expert mode, run the global command script version as shown in this table:

Gaia gClish Command

Global Command in the Expert mode

arp

g_arp

cat

g_cat

cp

g_cp

dmesg

g_dmesg

ethtool

g_ethtool

ifconfig

asg_ifconfig

ls

g_ls

md5sum

g_md5sum

mv

g_mv

netstat

g_netstat

reboot

g_reboot

tail

g_tail

tcpdump

g_tcpdump

top

g_top

Notes:

  • The parameters and options for the standard Linux command are available for the global command.

  • You can use one or more flags.

  • Do not use these two flags together in the same command:

    • The "-l" flag - to execute the command only on the local Security Group Member

    • The "-r" flag - to execute the command only on the remote Security Group Member

Syntax

  • In Gaia Clish:

    <Gaia gClish Command> [-b <SGM IDs>] <Command Options>]

  • In the Expert mode:

    <Global Expert mode Command> [-b <SGM IDs>] <Command Options>]

Parameters

Parameter

Description

<Gaia gClish Command>

Standard command in Gaia gClish as appears in the table above.

<Global Expert mode Command>

Global command in the Expert mode as appears in the table above.

-b <SGM IDs>

Applies to Security Group Members as specified by the <SGM IDs>.

<SGM IDs> can be:

  • No <SGM IDs> specified, or all

    Applies to all Security Group Members and all Maestro Sites

  • One Security Group Member (for example, 1_1)

Note - You can only select Security Group Members from one Site with this option.

<Command Options>

Standard command options for the specified command.

Below are explanations about some of the global commands.

Description

The global ls command shows the file in the specified directory on all Security Group Members.

Syntax

  • In Gaia Clish:

    ls [-b <SGM IDs>] <Command Options>]

  • In the Expert mode:

    g_ls [-b <SGM IDs>] <Command Options>]

Example

This example runs the 'g_ls' command in the Expert mode on Security Group Members 1_1, 1_2, and 1_3.

The example output shows the combined results for these Security Group Members.

[Expert@HostName-ch0x-0x:0]# g_ls -b 1_1-1_3,2_1 /var/
-*- 4 blades: 1_01 1_02 1_03 -*-
CPbackup    ace    crash  lib   log   opt       run    suroot
CPsnapshot  cache  empty  lock  mail  preserve  spool  tmp
[Expert@HostName-ch0x-0x:0]#

Description

The global reboot command reboots all Security Group Members.

Syntax

  • In Gaia Clish:

    reboot [-a]

  • In the Expert mode:

    g_reboot [-a]

Parameters

Parameter

Description

No Parameters

Reboots all Security Group Members that are in the state "UP".

-a

Reboots all Security Group Members that in the DOWN and the UP states.

Description

The global top command:

  • Shows CPU utilization in real time on Security Group Members.

  • Uses the local Security Group Member configuration file (~/.toprc) to format the output on the remote Security Group Members.

    The command copies this file to the remote Security Group Members.

Syntax

  • In Gaia Clish:

    top -h

    top [local] [-f [-o <Output File>] [-n <Number of Iterations>]] -b <SGM IDs> [<Command Options>]

    top [local] [s <Output File>] -b <SGM IDs> [<Command Options>]

  • In the Expert mode:

    g_top -h

    g_top [local] [-f [-o <Output File>] [-n <Number of Iterations>]] -b <SGM IDs> [<Command Options>]

    g_top [local] [s <Output File>] -b <SGM IDs> [<Command Options>]

Parameters

Parameter

Description

-h

Shows the built-in help.

local

Uses the 'top' configuration file (~/.toprc) on the local Security Group Member.

-f

Exports the output to a file.

Default: /vat/log/gtop.<Time>

-o <Output File>

Specifies the path and name of the output file.

Must use with the "-f" parameter.

-n <Number of Iterations>

The command saves the output the specified number of times.

Default: 1

Must use with the "-f" parameter.

-s <Output File>

Shows the content of the output file <Output File>, in which the command saved its output earlier.

<Command Options>

Parameters of the standard top command.

For more information, see the top command documentation.

Configuring the 'g_top' output

Step

Instructions

1

Connect to the command line on the Security Group.

2

 Log in to the Expert mode.

3

Run:

top

4

Set the desired view (press h to see the built-in help).

5

Press Shift+W to save the 'top' configuration.

6

Run:

g_top

Description

The global arp command shows the ARP cache table on all Security Group Members.

Syntax

  • In Gaia Clish:

    arp [-b <SGM IDs>] <Command Options>]

  • In the Expert mode:

    g_arp [-b <SGM IDs>] <Command Options>]

Example - ARP table on all interfaces of all Security Group Members

[Expert@HostName-ch0x-0x:0]# gclish
[Global] HostName-ch01-01 > arp
1_01:
Address     HWtype  HWaddress           Flags Mask   Iface
192.0.2.2   ether   00:1C:7F:02:04:FE   C            Sync
172.23.9.28 ether   00:14:22:09:D2:22   C            eth1-Mgmt4
192.0.2.3   ether   00:1C:7F:03:04:FE   C            Sync
1_02:
Address     HWtype  HWaddress           Flags Mask   Iface
192.0.2.3   ether   00:1C:7F:03:04:FE   C            Sync
172.23.9.28 ether   00:14:22:09:D2:22   C            eth1-Mgmt4
192.0.2.1   ether   00:1C:7F:01:04:FE   C            Sync
1_03:
Address     HWtype  HWaddress           Flags Mask   Iface
192.0.2.1   ether   00:1C:7F:01:04:FE   C            Sync
172.23.9.28 ether   00:14:22:09:D2:22   C            eth1-Mgmt4
192.0.2.2   ether   00:1C:7F:02:04:FE   C            Sync
[Global] HostName-ch01-01 >