Working with Configuration Parameters on Gaia OS

Background

On a Gaia server, you can control the default behavior of specific features by changing the values of the corresponding Check Point configuration parameters.

In the versions R82 and lower, you must configure the required values of the Check Point configuration parameters in various configuration files.

For example:

  • You configure the Firewall kernel parameters in the $FWDIR/boot/modules/fwkern.conf file.

  • You configure the SecureXL kernel parameters in the $PPKDIR/conf/simkern.conf file.

Starting in R82.10, you can view and configure the required values of the Check Point configuration parameters in these ways:

Configuration Method

Description and Instructions

Centralized

Database

Important:

The R82.10 release contains the new infrastructure.

The information below describes the complete feature as if it already supports the configuration of kernel parameters.

Important - The centralized database has a higher priority than the legacy configuration files.

This method changes the value of the Check Point configuration parameters (in the current session, or permanently) in a centralized database instead of editing the legacy configuration files.

This feature is called "Unified Configuration" (also known as "Config Point").

Use one of these commands:

Notes:

  • You can see the configuration parameters and their values in Gaia Portal:

    https://<IPv4 Address of Gaia/param_docs

  • On a Security Gateway, during an upgrade to R82.10 and during each boot of R82.10, Gaia OS automatically:

    1. Transfers the configured kernel parameters (that are not commented out) from the legacy configuration files $FWDIR/boot/modules/fwkern.conf and $PPKDIR/conf/simkern.conf to the centralized database.

      Support for more legacy configuration files is planned for later versions.

    2. Comments out the configured kernel parameters in the legacy configuration files (adds the # character in the beginning of the line and adds the corresponding command at the end of the line).

  • On a Security Gateway, if a kernel parameter value is already configured in the centralized database, and you configure a value for the same kernel parameter in the legacy configuration file, then during the next boot, the value from the legacy configuration file overrides the previous value in the centralized database.

Legacy

Configuration Files

This method changes the value of the Check Point kernel parameter on a Security Gateway in one of the legacy configuration files as done in R81.20 and lower.

For example, you configure kernel parameters in these files:

  • $FWDIR/boot/modules/fwkern.conf

  • $PPKDIR/conf/simkern.conf

Use these CLI commands (in Gaia Clish or the Expert mode) to configure kernel parameters:

  • fw ctl get int ...

  • fw ctl get str ...

  • fw ctl set [-f] int ...

  • fw ctl set [-f] str ...

For the complete legacy procedure to configure kernel parameters, see the R82.10 Quantum Security Gateway Guide > Chapter "Working with Kernel Parameters".

View Configuration Parameters in the Unified Configuration Reference

You can see the information about the configuration parameters and their values in the Unified Configuration Reference on your Gaia server.

With a web browser, connect to:

https://<IPv4 Address of Gaia/param_docs

  • In the left panel, click the applicable parameter category.

  • In the right panel:

    • At the top left, you can filter the list of parameters by their name and path.

    • At the top right, you can export the parameters as a CSV file.

      If you filtered the list of parameters, this file saves only the parameters that you see on the page.

    • Click anywhere in the parameter row to see its information:

      • Parameter Name and Path

      • Parameter Description

      • Type and Valid Values

      • Default Value

      • Pending the Action

      • Supported Platforms

      • VSNext / Traditional VSX

CLI Syntax to View Configuration Parameters in Gaia Clish / Gaia gClish

Notes:

  • On a VSNext Security Group / Traditional VSX Gateway, you must go to the context of the of the applicable Virtual Gateway / Virtual System:

    set virtual-system <ID>

  • The command "show param" does not show the kernel parameters configured in the legacy configuration files.

show param all

      [filter-by]

            modified

                  [format {json | yaml | table} [verbose-level <0-3>]]

            not-default

                  [format {json | yaml | table} [verbose-level <0-3>]]

            with-comments

                  [format {json | yaml | table} [verbose-level <0-3>]]

      [format {json | yaml | table} [verbose-level <0-3>]]

show param path {<Full Parameter Path in DB> | <Path with Wildcards in DB>}

      [field]

            comments

            description

            default_value

            pending_value

      [filter-by]

            modified

                  [format {json | yaml | table} [verbose-level <0-3>]]

            not-default

                  [format {json | yaml | table} [verbose-level <0-3>]]

            with-comments

                  [format {json | yaml | table} [verbose-level <0-3>]]

      [format {json | yaml | table} [verbose-level <0-3>]]

      [key <Path of Parameter Key>]

Parameter

Description

show param all

Shows all configuration parameters with values, descriptions, and comments.

show param path <Path in DB>

Specifies the path of a configuration parameter in the database:

  • <Full Parameter Path in DB>

    Shows the configuration parameter based on its full path in the database.

  • <Path with Wildcards in DB>

    Shows the configuration parameters based on the specified path with wildcards "*" in the database:

    1. Enter the relevant path characters (at least 2 characters).

    2. Enter the * character in the relevant place.

    3. If needed, enter the relevant path characters.

    4. Press the Space key.

    5. Enter the sub-command "use-regex true".

    6. Press the Tab key to see the next available sub-command.

field

Specifies which fields to show for the configuration parameter(s):

  • comments

    Shows only the comment (shows "null" if there is no comment configured).

  • description

    Shows only the description.

  • default_value

    Shows only the default value.

  • pending_value

    Shows only the pending value (shows "null" if there is no such value configured).

filter-by

Specifies a filter for the output:

  • modified

    Shows configuration parameters, whose values were configured explicitly.

  • not-default

    Shows configuration parameters, whose values are not default.

  • with-comments

    Shows configuration parameters with configured comments.

format {json | yaml | table}

Specifies the output format:

  • json

    JSON.

  • yaml

    YAML.

  • table

    Table (this is the default).

verbose-level <0-3>

Specifies the verbose level for the JSON and YAML formats:

  • 0

    Simplified format (this is the default).

    • The parameter path.

    • The current value.

  • 1

    Standard format with basic details.

    • The parameter path.

    • The current value.

    • The default value.

  • 2

    Advanced format with more details.

    • The parameter path.

    • The current value.

    • The default value.

    • The pending value and the required action.

    • The comment.

  • 3

    Detailed format (all information).

    • The parameter path.

    • The current value.

    • The default value.

    • The pending value and the required action.

    • The comment.

    • The description.

    • The "last modified" information (username, time and state, previous value).

    • The Virtual System ID:

      • In the Gateway mode, the value is always 0.

      • In the VSNext / Traditional VSX mode, the value is the applicable ID.

key <Path of Parameter Key>

Specifies the internal key path for the specific key.

Example: Enter "name[eth0].ipaddr" to get the IP address of the interface "eth0".

CLI Syntax to Configure Configuration Parameters in Gaia Clish / Gaia gClish

Notes:

  • On a VSNext Security Group / Traditional VSX Gateway, you must go to the context of the of the applicable Virtual Gateway / Virtual System:

    set virtual-system <ID>

  • The "set param" command saves the change automatically.

    You do not need to run the "save config" command.

set param path <Parameter Path in DB>

      comment "Comment Text"

      key <Key Path> key-value <Key Value>

      param-value <Parameter Value>

            comment "Comment Text" use-regex {true | false} dry-run {true | false}

            use-regex {true | false} dry-run {true | false}

            volatile true use-regex {true | false} dry-run {true | false}

      use-default {true | false}

            comment "Comment Text" use-regex {true | false} dry-run {true | false}

            use-regex {true | false} dry-run {true | false}

            volatile true use-regex {true | false} dry-run {true | false}

      volatile {true | false} use-regex {true | false} dry-run {true | false}

Parameter

Description

set param path <Parameter Path in DB>

Configures the configuration parameter settings in the database.

You must specify one of these paths for the configuration parameter:

  • The full path in the database.

  • The path with wildcards "*" in the database:

    1. Enter the relevant path characters (at least 2 characters).

    2. Enter the * character in the relevant place.

    3. If needed, enter the relevant path characters.

    4. Press the Space key.

    5. Enter the sub-command "use-regex true".

    6. Press the Tab key to see the next available sub-command.

comment "Comment Text"

Configures the comment text (up to 256 characters) for the specified configuration parameter(s).

key <Key Path> key-value <Key Value>

Configures the key in the parameter (if this parameter contains keys).

  • key <Key Path>

    Specifies the internal key path for the specific key.

  • key-value <Key Value>

    Based on the key type, the key value can be one of these:

    • An integer.

      Theoretical example:

      set param path gaia.auth_servers.radius key auth_order key-value 1

    • A boolean.

      Theoretical example:

      set param path gaia.dns1 key use_dns key-value true

    • An ASCII string.

      Theoretical example:

      set param path gaia.dns1 key primary key-value "1.1.1.1"

    • A JSON set.

      Theoretical example:

      set param path gaia.users key name[admin].groups key-value '{"update":[{"name":"gadmin","gid":0}]}'

    • An object.

      Theoretical example:

      set param path gaia.dns1 param-value '{"primary":"1.1.1.1","secondary":"2.2.2.2"}'

param-value <Parameter Value>

Configures a new value for the specified configuration parameter(s).

Different configuration parameters accept different value types:

  • An integer.

  • A boolean (true, false).

  • A string.

The required values are provided in Check Point Support Center and by Check Point Support Engineers.

use-default {true | false}

Specifies whether to configure (true) or not (false) the default value for the specified configuration parameter.

Default: false

volatile {true | false}

Specifies whether to configure the new value only temporarily for the specified configuration parameter:

Important - By default, the new value is configured permanently.

  • volatile true

    Configures the new value for the specified configuration parameter only temporary - until the next reboot, or until you run "volatile false".

    During the next boot, the previous value of the specified configuration parameter is restored.

  • volatile false

    Restores the previous value for the specified configuration parameter after you ran "volatile true".

use-regex {true | false}

Specifies whether the specified configuration parameter's path includes wildcards "*" (true) or not (false).

Default: false

dry-run {true | false}

Specifies whether to save the new value for the specified configuration parameter permanently in the database:

  • dry-run true

    Does not save the new value for the specified configuration parameter - the change does not survive the reboot.

  • dry-run false

    Saves the new value for the specified configuration parameter - the change survives the reboot.