cpca_client set_mgmt_tool
Description
Controls the ICA Internal Certificate Authority. A component on Check Point Management Server that issues certificates for authentication. Management Tool.
|
Note: On a Multi-Domain Server Dedicated Check Point server that runs Check Point software to host virtual Security Management Servers called Domain Management Servers. Synonym: Multi-Domain Security Management Server. Acronym: MDS., you must run this command in the context of the applicable Domain Management Server Check Point Single-Domain Security Management Server or a Multi-Domain Security Management Server.:
|
See sk102837: Best Practices - ICA Management Tool configuration
Syntax
|
Parameters
Parameter |
Description |
||
---|---|---|---|
|
Runs the command in debug mode. Use only if you troubleshoot the command itself.
|
||
|
Starts the ICA Management Tool. |
||
|
Stops the ICA Management Tool. |
||
|
Adds the specified administrator, user, or custom user that is permitted to use the ICA Management Tool. |
||
|
Removes the specified administrator, user, or custom user that is permitted to use the ICA Management Tool. |
||
|
Removes all administrators, users, or custom users that are permitted to use the ICA Management Tool. |
||
|
Shows the configured administrators, users, or custom users that are permitted to use the ICA Management Tool. |
||
|
Optional. Specifies the TCP port on the Security Management Server Dedicated Check Point server that runs Check Point software to manage the objects and policies in a Check Point environment within a single management Domain. Synonym: Single-Domain Security Management Server. or Domain Management Server, which is used to connect to the Certificate Authority. The default TCP port number is 18265. |
||
|
Optional. Specifies the DN of the administrator that is permitted to use the ICA Management Tool. Must specify the full DN as appears in SmartConsole Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on. Procedure
Example:
|
||
|
Optional. Specifies the DN of the user that is permitted to use the ICA Management Tool. Must specify the full DN as appears in SmartConsole: Procedure
Example:
|
||
|
Optional. Specifies the DN for the custom user that is permitted to use the ICA Management Tool. Must specify the full DN as appears in SmartConsole. Procedure
Example:
|
|
Note - If you run the " |
To connect to the ICA Management Tool
-
In SmartConsole, configure the required administrator and user objects.
You must create a certificate for these administrators and users.
You use this certificate to configure the permitted users in the ICA Management Tool and in the client web browsers.
-
In the command line on the Management Server, add the required administrators and users that are permitted to use the ICA Management Tool.
cpca_client set_mgmt_tool add ...
-
In the command line on the Management Server, start the ICA Management Tool.
cpca_client set_mgmt_tool on
-
Check the status of the ICA Management Tool:
cpca_client set_mgmt_tool print
-
Import the administrator's / user's certificate into the Windows Certificate Store:.
-
Right-click the *.p12 file you saved when you created the required administrator / user, and click Install PFX.
The Certificate Import Wizard opens.
-
In the Store Location section, select the applicable option:
-
Current User (this is the default)
-
Local Machine
-
-
Click Next.
-
Enter the same certificate password you used when you created the required administrator / user certificate.
-
Clear Enable strong private key protection.
-
Select Mark this key as exportable.
-
Click Next.
-
Select Place all certificates in the following store > click Browse > select Personal > click OK.
-
Click Next.
-
Click Finish.
-
-
In a web browser, connect to the ICA Management Tool:
https://<IP Address of the Management Server>:18265
Important - The fact that the TCP port 18265 is open is not a vulnerability. The ICA Management Tool Portal is secured and protected by SSL. In addition, only authorized administrators and users are allowed to access it using a certificate.
-
A dialog box with this message appears:
Client Authentication
Identification
The Web site you want to view requests identification.
Select the certificate to use when connecting.
-
Select the appropriate certificate for authenticating to the ICA Management Tool.
-
Click OK.
-
In the Security Alert dialog box, click Yes.