Firewall Kernel Parameters

To change the internal default behavior of Firewall or to configure special advanced settings for Firewall, you can use Firewall kernel parameters.

The names of applicable Firewall kernel parameters and their values appear in various SK articles in Check Point Support Center, and provided by Check Point Support.

Important:

Type

Name

Integer

fw_allow_simultaneous_ping

fw_kdprintf_limit

fw_log_bufsize

send_buf_limit

String

simple_debug_filter_addr_1

simple_debug_filter_daddr_1

simple_debug_filter_vpn_1

ws_debug_ip_str

fw_lsp_pair1

Working with Integer Kernel Parameters

Step

Instructions

1

Connect to the command line on your Security GatewayClosed Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. / each Cluster MemberClosed Security Gateway that is part of a cluster..

Note - On Scalable Platforms, you must connect to the GaiaClosed Check Point security operating system that combines the strengths of both SecurePlatform and IPSO operating systems. Portal of the applicable Security Group.

2

Log in to Gaia ClishClosed The name of the default command line shell in Check Point Gaia operating system. This is a restricted shell (role-based administration controls the number of commands available in the shell). or the Expert mode.

Note - On Scalable Platforms, you must run the applicable commands in Gaia gClishClosed The name of the global command line shell in Check Point Gaia operating system for Security Appliances connected to Check Point Quantum Maestro Orchestrators and for Security Gateway Modules on Scalable Chassis. Commands you run in this shell apply to all Security Gateway Module / Security Appliances in the Security Group. or the Expert mode of the applicable Security Group.

3

Get the current value of an integer kernel parameter:

  • On the Security Gateway / each Cluster Member, run in Gaia Clish or the Expert mode:

    fw ctl get int <Name of Integer Kernel Parameter> [-a]

  • On the Scalable Platform Security Group, run in Gaia gClish:

    fw ctl get int <Name of Integer Kernel Parameter> [-a]

  • On the Scalable Platform Security Group, run in the Expert mode:

    g_fw ctl get int <Name of Integer Kernel Parameter> [-a]

Example:

[Expert@MyGW:0]# fw ctl get int send_buf_limit
send_buf_limit = 80
[Expert@MyGW:0]#

Important - This change does not survive reboot.

Step

Instructions

1

Connect to the command line on your Security Gateway / each Cluster Member.

Note - On Scalable Platforms, you must connect to the Gaia Portal of the applicable Security Group.

2

Log in to Gaia Clish or the Expert mode.

Note - On Scalable Platforms, you must run the applicable commands in Gaia gClish or the Expert mode of the applicable Security Group.

3

Configure the new value for an integer kernel parameter:

  • On a Security Gateway / each Cluster Member, run in Gaia Clish or the Expert mode:

    fw ctl set int <Name of Integer Kernel Parameter> <Integer Value>

  • On a Scalable Platform Security Group, run in Gaia gClish:

    fw ctl set int <Name of Integer Kernel Parameter> <Integer Value>

  • On a Scalable Platform Security Group, run in the Expert mode:

    g_fw ctl set int <Name of Integer Kernel Parameter> <Integer Value>

Example:

[Expert@MyGW:0]# fw ctl set int send_buf_limit 100
Set operation succeeded
[Expert@MyGW:0]#

4

Make sure the new value is configured.

  • On a Security Gateway / each Cluster Member, run in Gaia Clish or the Expert mode:

    fw ctl get int <Name of Integer Kernel Parameter>

  • On a Scalable Platform Security Group, run in Gaia gClish:

    fw ctl get int <Name of Integer Kernel Parameter>

  • On a Scalable Platform Security Group, run in the Expert mode:

    g_fw ctl get int <Name of Integer Kernel Parameter>

Example:

[Expert@MyGW:0]# fw ctl get int send_buf_limit
send_buf_limit = 100
[Expert@MyGW:0]#

To make a kernel parameter configuration permanent (to survive reboot), you must edit the configuration file:

$FWDIR/boot/modules/fwkern.conf

The exact parameters appear in various SK articles in Check Point Support Center, and provided by Check Point Support.

Step

Instructions

1

Connect to the command line on your Security Gateway / each Cluster Member.

Note - On Scalable Platforms, you must connect to the Gaia Portal of the applicable Security Group.

2

Log in to the Expert mode.

3

Back up the current configuration file, if it exists:

  • On the Security Gateway (each Cluster Member), run:

    cp -v $FWDIR/boot/modules/fwkern.conf{,_BKP}

  • On the Scalable Platform Security Group, run:

    g_all cp -v $FWDIR/boot/modules/fwkern.conf{,_BKP}

4

Configure the required Firewall kernel parameter with the assigned value in the exact format specified below.

  • On the Security Gateway (each Cluster Member), run:

    fw ctl set -f int <Name_of_Integer_Kernel_Parameter> <Integer_Value>

  • On the Scalable Platform Security Group, run one of these commands:

    g_fw ctl set -f int <Name_of_Integer_Kernel_Parameter> <Integer_Value>

    g_update_conf_file fwkern.conf <Name_of_Integer_Kernel_Parameter>=<Integer_Value>

Example:

[Expert@MyGW:0]# fw ctl set -f int send_buf_limit 100
"fwkern.conf" was updated successfully
[Expert@MyGW:0]#

[Expert@MyGW:0]# g_update_conf_file fwkern.conf send_buf_limit=100
"fwkern.conf" was updated successfully
[Expert@MyGW:0]#

5

Examine the configuration file.

  • On the Security Gateway (each Cluster Member), run:

    cat $FWDIR/boot/modules/fwkern.conf

  • On the Scalable Platform Security Group, run:

    g_allc cat $FWDIR/boot/modules/fwkern.conf

6

Reboot.

  • On the Security Gateway / Cluster Member, run:

    reboot

    Important - In cluster, this can cause a failover.

  • On the Scalable Platform Security Group, run:

    g_reboot -a

7

Connect to the command line on your Security Gateway / each Cluster Member.

Note - On Scalable Platforms, you must connect to the Gaia Portal of the applicable Security Group.

8

Log in to Gaia Clish or the Expert mode.

Note - On Scalable Platforms, you must run the applicable commands in Gaia gClish or the Expert mode of the applicable Security Group.

9

Make sure the new value of the kernel parameter is configured.

  • On a Security Gateway / each Cluster Member, run:

    fw ctl get int <Name of Integer Kernel Parameter> [-a]

  • On a Scalable Platform Security Group, run:

    g_fw ctl get int <Name of Integer Kernel Parameter> [-a]

For more information, see sk26202: Changing the kernel global parameters for Check Point Security Gateway.

Step

Instructions

1

Connect to the command line on your Security Gateway / each Cluster Member.

Note - On Scalable Platforms, you must connect to the Gaia Portal of the applicable Security Group.

2

Log in to the Expert mode.

3

See if the configuration file already exists.

  • On a Security Gateway / each Cluster Member:

    ls -l $FWDIR/boot/modules/fwkern.conf

  • On a Scalable Platform Security Group:

    g_allc ls -l $FWDIR/boot/modules/fwkern.conf

4

If this file already exists, skip to Step 5.

If this file does not exist, then create it manually and then skip to Step 6.

  • On a Security Gateway / each Cluster Member:

    touch $FWDIR/boot/modules/fwkern.conf

  • On a Scalable Platform Security Group:

    g_all touch $FWDIR/boot/modules/fwkern.conf

5

Back up the current configuration file.

  • On a Security Gateway / each Cluster Member:

    cp -v $FWDIR/boot/modules/fwkern.conf{,_BKP}

  • On a Scalable Platform Security Group:

    g_all cp -v $FWDIR/boot/modules/fwkern.conf{,_BKP}

6

Edit the current configuration file.

The same syntax applies to the Security Gateway / each Cluster Member and the Scalable Platform Security Group:

vi $FWDIR/boot/modules/fwkern.conf

7

Add the required Firewall kernel parameter with the assigned value in the exact format specified below.

Important - These configuration files do not support space characters, tabulation characters, and comments (lines that contain the # character).

<Name_of_Integer_Kernel_Parameter>=<Integer_Value>

8

Save the changes in the file and exit the editor.

9

On the Scalable Platform Security Group, copy the updated configuration file to all other Security Group MembersClosed Member of a Security Group in ElasticXL Cluster, Maestro, and Scalable Chassis. Acronym: SGM.:

asg_cp2blades $FWDIR/boot/modules/fwkern.conf

10

Reboot.

  • On the Security Gateway / Cluster Member, run:

    reboot

    Important - In cluster, this can cause a failover.

  • On the Scalable Platform Security Group, run:

    g_reboot -a

11

Connect to the command line on your Security Gateway / each Cluster Member.

Note - On Scalable Platforms, you must connect to the Gaia Portal of the applicable Security Group.

12

Log in to Gaia Clish or the Expert mode.

Note - On Scalable Platforms, you must run the applicable commands in Gaia gClish or the Expert mode of the applicable Security Group.

13

Make sure the new value of the kernel parameter is configured.

  • On a Security Gateway / each Cluster Member, run in Gaia Clish or the Expert mode:

    fw ctl get int <Name of Integer Kernel Parameter> [-a]

  • On a Scalable Platform Security Group, run in Gaia gClish:

    fw ctl get int <Name of Integer Kernel Parameter> [-a]

  • On a Scalable Platform Security Group, run in the Expert mode:

    g_fw ctl get int <Name of Integer Kernel Parameter> [-a]

Working with String Kernel Parameters

Step

Instructions

1

Connect to the command line on your Security Gateway / each Cluster Member.

Note - On Scalable Platforms, you must connect to the Gaia Portal of the applicable Security Group.

2

Log in to Gaia Clish or the Expert mode.

Note - On Scalable Platforms, you must run the applicable commands in Gaia gClish or the Expert mode of the applicable Security Group.

3

Get the current value of a string kernel parameter:

  • On the Security Gateway / each Cluster Member, run in Gaia Clish or the Expert mode:

    fw ctl get str <Name of String Kernel Parameter> [-a]

  • On the Scalable Platform Security Group, run in Gaia gClish:

    fw ctl get str <Name of String Kernel Parameter> [-a]

  • On the Scalable Platform Security Group, run in the Expert mode:

    g_fw ctl get str <Name of String Kernel Parameter> [-a]

Example:

[Expert@MyGW:0]# fw ctl get str fileapp_default_encoding_charset
fileapp_default_encoding_charset = 'UTF-8'
[Expert@MyGW:0]#

Important - This change does not survive reboot.

Step

Instructions

1

Connect to the command line on your Security Gateway / each Cluster Member.

Note - On Scalable Platforms, you must connect to the Gaia Portal of the applicable Security Group.

2

Log in to Gaia Clish or the Expert mode.

Note - On Scalable Platforms, you must run the applicable commands in Gaia gClish or the Expert mode of the applicable Security Group.

3

Configure the new value for a string kernel parameter.

Note - You must write the value in single quotes, or double quotes. Use one of these syntax options.

  • On a Security Gateway / each Cluster Member, run in Gaia Clish or the Expert mode:

    fw ctl set str <Name of String Kernel Parameter> '<String Text>'

    or

    fw ctl set str <Name of String Kernel Parameter> "<String Text>"

  • On a Scalable Platform Security Group, run in Gaia gClish:

    fw ctl set str <Name of String Kernel Parameter> '<String Text>'

    or

    fw ctl set str <Name of String Kernel Parameter> "<String Text>"

  • On a Scalable Platform Security Group, run in the Expert mode:

    g_fw ctl set str <Name of String Kernel Parameter> '<String Text>'

    or

    g_fw ctl set str <Name of String Kernel Parameter> "<String Text>"

Example:

[Expert@MyGW:0]# fw ctl set str debug_filter_saddr_ip '1.1.1.1'
Set operation succeeded
[Expert@MyGW:0]#

4

Make sure the new value is configured.

  • On a Security Gateway / each Cluster Member, run in Gaia Clish or the Expert mode:

    fw ctl get str <Name of String Kernel Parameter>

  • On a Scalable Platform Security Group, run in Gaia gClish:

    fw ctl get str <Name of String Kernel Parameter>

  • On a Scalable Platform Security Group, run in the Expert mode:

    g_fw ctl get str <Name of String Kernel Parameter>

Example:

[Expert@MyGW:0]# fw ctl get str debug_filter_saddr_ip
debug_filter_saddr_ip = '1.1.1.1'
[Expert@MyGW:0]#

To make a kernel parameter configuration permanent (to survive reboot), you must edit one of the applicable configuration file:

$FWDIR/boot/modules/fwkern.conf

The exact parameters appear in various SK articles in Check Point Support Center, and provided by Check Point Support.

Step

Instructions

1

Connect to the command line on your Security Gateway / each Cluster Member.

Note - On Scalable Platforms, you must connect to the Gaia Portal of the applicable Security Group.

2

Log in to the Expert mode.

3

Back up the current configuration file, if it exists:

  • On the Security Gateway (each Cluster Member), run:

    cp -v $FWDIR/boot/modules/fwkern.conf{,_BKP}

  • On the Scalable Platform Security Group, run:

    g_all cp -v $FWDIR/boot/modules/fwkern.conf{,_BKP}

4

Configure the required Firewall kernel parameter with the assigned value in the exact format specified below.

Note - You must write the value in single quotes, or double quotes. Use one of these syntax options.

  • On a Security Gateway / each Cluster Member, run in Gaia Clish or the Expert mode:

    fw ctl set -f str <Name_of_String_Kernel_Parameter> '<String_Text>'

    or

    fw ctl set -f str <Name_of_String_Kernel_Parameter> "<String_Text>"

  • On a Scalable Platform Security Group, run in the Expert mode:

    g_fw ctl set -f str <Name_of_String_Kernel_Parameter> '<String_Text>'

    or

    g_fw ctl set -f str <Name_of_String_Kernel_Parameter> "<String_Text>"

Example:

[Expert@MyGW:0]# fw ctl set -f str ws_debug_ip_str '1.1.1.1'
"fwkern.conf" was updated successfully
[Expert@MyGW:0]#

5

Examine the configuration file.

  • On the Security Gateway / each Cluster Member, run:

    cat $FWDIR/boot/modules/fwkern.conf

  • On the Scalable Platform Security Group, run:

    g_allc cat $FWDIR/boot/modules/fwkern.conf

6

Reboot.

  • On the Security Gateway / Cluster Member, run:

    reboot

    Important - In cluster, this can cause a failover.

  • On the Scalable Platform Security Group, run:

    g_reboot -a

7

Connect to the command line on your Security Gateway / each Cluster Member.

Note - On Scalable Platforms, you must connect to the Gaia Portal of the applicable Security Group.

8

Log in to Gaia Clish or the Expert mode.

Note - On Scalable Platforms, you must run the applicable commands in Gaia gClish or the Expert mode of the applicable Security Group.

9

Make sure the new value of the kernel parameter is configured.

  • On a Security Gateway / each Cluster Member, run in Gaia Clish or the Expert mode:

    fw ctl get str <Name of String Kernel Parameter> [-a]

  • On a Scalable Platform Security Group, run in Gaia gClish:

    fw ctl get str <Name of String Kernel Parameter> [-a]

  • On a Scalable Platform Security Group, run in the Expert mode:

    g_fw ctl get str <Name of String Kernel Parameter> [-a]

For more information, see sk26202: Changing the kernel global parameters for Check Point Security Gateway.

Step

Instructions

1

Connect to the command line on your Security Gateway / each Cluster Member.

Note - On Scalable Platforms, you must connect to the Gaia Portal of the applicable Security Group.

2

Log in to the Expert mode.

3

See if the configuration file already exists.

  • On a Security Gateway / each Cluster Member:

    ls -l $FWDIR/boot/modules/fwkern.conf

  • On a Scalable Platform Security Group:

    g_all ls -l $FWDIR/boot/modules/fwkern.conf

4

If this file already exists, skip to Step 5.

If this file does not exist, then create it manually and then skip to Step 6.

  • On a Security Gateway / each Cluster Member:

    touch $FWDIR/boot/modules/fwkern.conf

  • On a Scalable Platform Security Group:

    g_all touch $FWDIR/boot/modules/fwkern.conf

5

Back up the current configuration file.

  • On a Security Gateway / each Cluster Member:

    cp -v $FWDIR/boot/modules/fwkern.conf{,_BKP}

  • On a Scalable Platform Security Group:

    g_all cp -v $FWDIR/boot/modules/fwkern.conf{,_BKP}

6

Edit the current configuration file.

The same syntax applies to the Security Gateway / each Cluster Member and the Scalable Platform Security Group:

vi $FWDIR/boot/modules/fwkern.conf

7

Add the required kernel parameter with the assigned value in the exact format specified below.

Important - These configuration files do not support space characters, tabulation characters, and comments (lines that contain the # character).

Note - You must write the value in single quotes, or double quotes. Use one of these syntax options.

<Name_of_String_Kernel_Parameter>='<String_Text>'

or

<Name_of_String_Kernel_Parameter>="<String_Text>"

8

Save the changes in the file and exit the editor.

9

On the Scalable Platform Security Group, copy the updated configuration file to all other Security Group Members:

asg_cp2blades $FWDIR/boot/modules/fwkern.conf

10

Reboot.

  • On the Security Gateway / Cluster Member, run:

    reboot

    Important - In cluster, this can cause a failover.

  • On the Scalable Platform Security Group, run:

    g_reboot -a

11

Connect to the command line on your Security Gateway / each Cluster Member.

Note - On Scalable Platforms, you must connect to the Gaia Portal of the applicable Security Group.

12

Log in to Gaia Clish or the Expert mode.

Note - On Scalable Platforms, you must run the applicable commands in Gaia gClish or the Expert mode of the applicable Security Group.

13

Make sure the new value of the kernel parameter is configured.

  • On a Security Gateway / each Cluster Member, run in Gaia Clish or the Expert mode:

    fw ctl get str <Name of String Kernel Parameter> [-a]

  • On a Scalable Platform Security Group, run in Gaia gClish:

    fw ctl get str <Name of String Kernel Parameter> [-a]

  • On a Scalable Platform Security Group, run in the Expert mode:

    g_fw ctl get str <Name of String Kernel Parameter> [-a]

Important - This change does not survive reboot.

Step

Instructions

1

Connect to the command line on your Security Gateway or Cluster Member.

Note - On Scalable Platforms, you must connect to the Gaia Portal of the applicable Security Group.

2

Log in to Gaia Clish or the Expert mode.

Note - On Scalable Platforms, you must run the applicable commands in Gaia gClish or the Expert mode of the applicable Security Group.

3

Clear the current value from a string kernel parameter:

Note - You must set an empty value in single quotes, or double quotes. Use one of these syntax options.

  • On a Security Gateway / each Cluster Member, run in Gaia Clish or the Expert mode:

    fw ctl set str '<Name of String Kernel Parameter>'

    or

    fw ctl set str "<Name of String Kernel Parameter>"

  • On a Scalable Platform Security Group, run in Gaia gClish:

    fw ctl set str '<Name of String Kernel Parameter>'

    or

    fw ctl set str "<Name of String Kernel Parameter>"

  • On a Scalable Platform Security Group, run in the Expert mode:

    g_fw ctl set str '<Name of String Kernel Parameter>'

    or

    g_fw ctl set str "<Name of String Kernel Parameter>"

Example:

[Expert@MyGW:0]# fw ctl set str debug_filter_saddr_ip ''
Set operation succeeded
[Expert@MyGW:0]#

4

Make sure the value is cleared (the new value is empty):

  • On a Security Gateway / each Cluster Member, run in Gaia Clish or the Expert mode:

    fw ctl get str <Name of String Kernel Parameter>

  • On a Scalable Platform Security Group, run in Gaia gClish:

    fw ctl get str <Name of String Kernel Parameter>

  • On a Scalable Platform Security Group, run in the Expert mode:

    g_fw ctl get str <Name of String Kernel Parameter>

Example:

[Expert@MyGW:0]# fw ctl get str debug_filter_saddr_ip
debug_filter_saddr_ip = ''
[Expert@MyGW:0]#

Viewing the List of All Kernel Parameters and Their Values

Step

Instructions

1

Connect to the command line on your Security Gateway / each Cluster Member.

Note - On Scalable Platforms, you must connect to the Gaia Portal of the applicable Security Group.

2

Log in to the Expert mode.

3

Reset the kernel debug options:

fw ctl debug 0

3

Allocate the kernel debug buffer:

fw ctl debug -buf 8200

3

Start the kernel debug in the background:

fw ctl kdebug -T -f > /var/log/list_of_kernel_parameters_and_current_values.txt &

3

Enable the special kernel parameter to print the current values of all kernel parameters:

fw ctl set int listparams 1 -a

3

Wait for 30 seconds.

3

Reset the kernel debug options:

fw ctl debug 0

4

Refer to the output file:

/var/log/list_of_kernel_parameters_and_current_values.txt

  • The integer parameters appear as "(int)".

    Examples:

    kiss: fw_allow_simultaneous_ping (int) 0

    fw: fw_async_sxl_aggr_minimum_time (int) 5

    streaming: cpas_tcp_do_sack (int) 1

  • The string parameters appear as "(str)".

    Examples:

    fw: kiss_memory_report_out_dir (str) /var/log/tmp

    fw: fileapp_default_encoding_charset (str) UTF-8