Monitoring HTTPS Inspection with HSM in CLI
Run the "cpstat https_inspection" command on the Security Gateway
Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. / Cluster Member Security Gateway that is part of a cluster. / Scalable Platform Security Group A logical group of Security Appliances (in Maestro) / Security Gateway Modules (on Scalable Chassis) that provides Active/Active cluster functionality. A Security Group can contain one or more Security Appliances / Security Gateway Modules. Security Groups work separately and independently from each other. To the production networks, a Security Group appears a single Security Gateway. In Maestro, each Security Group contains: (A) Applicable Uplink ports, to which your production networks are connected; (B) Security Appliances (the Quantum Maestro Orchestrator determines the applicable Downlink ports automatically); (C) Applicable management port, to which the Check Point Management Server is connected. to see the HTTPS Inspection Feature on a Security Gateway that inspects traffic encrypted by the Secure Sockets Layer (SSL) protocol for malware or suspicious patterns. Synonym: SSL Inspection. Acronyms: HTTPSI, HTTPSi. status and the status of connection to the HSM Server.
Syntax
-
On the Security Gateway / each Cluster
Two or more Security Gateways that work together in a redundant configuration - High Availability, or Load Sharing. Member, run:cpstat -hcpstat https_inspection -f {default | hsm_status | all} -
On the Scalable Platform Security Group, run:
cpstat -hg_all cpstat https_inspection -f {default | hsm_status | all}
For more information about this command, see the R82.10 CLI Reference Guide > Chapter "Security Gateway Commands" > Section "cpstat".
Explanation about the "HSM configuration status"
|
Item |
Possible returned strings |
Explanation |
|
|---|---|---|---|
|
|
|
The value of the "https_inspection.hsm.enabled" parameter is set to "true" in the HSM configuration on the Security Gateway / Cluster Member / Security Group. |
|
|
|
One of these:
|
Explanation about the "HSM configuration status description"
|
Item |
Possible returned strings |
Explanation |
|
|---|---|---|---|
|
|
|
|
|
|
|
One of these:
|
Explanation about the "HSM partition access status"
|
Item |
Possible returned strings |
Explanation |
|
|---|---|---|---|
|
|
|
Security Gateway / Cluster Member / Security Group failed to check the access to its partition on the HSM Server. |
|
|
|
Security Gateway / Cluster Member / Security Group accessed its partition on the HSM Server. |
||
|
|
Security Gateway / Cluster Member / Security Group failed to access its partition on the HSM Server because of an error.
|
Explanation about the "HSM partition access status description"
|
Item |
Possible returned strings |
Explanation |
|
|---|---|---|---|
|
|
|
Security Gateway / Cluster Member / Security Group failed to check the access to its partition on the HSM Server. Most probably, because HSM configuration is disabled on the Security Gateway / Cluster Member / Security Group. |
|
|
|
Security Gateway / Cluster Member / Security Group accessed its partition on the HSM Server. |
||
|
|
Security Gateway / Cluster Member / Security Group failed to access its partition on the HSM Server because of an error. All these conditions were met:
Possible error messages are:
|
Explanation about the "Outbound HTTPS Inspection status"
|
Item |
Possible returned strings |
Explanation |
|
|---|---|---|---|
|
|
|
When the HTTPS Inspection starts, it is necessary to wait for one minute or less, until you can get the actual status. |
|
|
|
All these conditions were met:
|
||
|
|
One of these:
|
||
|
|
All these conditions were met:
|
Explanation about the "Outbound HTTPS Inspection status description"
|
Item |
Possible returned strings |
Explanation |
||
|---|---|---|---|---|
|
|
|
When the HTTPS Inspection starts, it is necessary to wait for one minute or less, until you can get the actual status. |
||
|
|
|
All these conditions were met:
|
||
|
|
|
The value of the "https_inspection.hsm.enabled" parameter is set to "false" in the HSM configuration on the Security Gateway / Cluster Member / Security Group. |
||
|
|
|
All these conditions were met:
Possible error messages are:
|