Working with Configuration Parameters on Gaia OS

Background

On a Gaia server, you can control the default behavior of specific features by changing the values of the corresponding Check Point configuration parameters.

In the versions R82 and lower, you must configure the required values of the Check Point configuration parameters in various configuration files.

For example:

  • You configure the Firewall kernel parameters in the $FWDIR/boot/modules/fwkern.conf file.

  • You configure the SecureXL kernel parameters in the $PPKDIR/conf/simkern.conf file.

You can view and configure the required values of the Check Point configuration parameters in these ways:

Configuration Method

Description and Instructions

Centralized

Database

Important - The centralized database has a higher priority than the legacy configuration files.

This method changes the value of the Check Point configuration parameters (in the current session, or permanently) in a centralized database instead of editing the legacy configuration files.

This feature is called "(Undefined variable: Vars_BladesFeatures.tp_unified_configuration)" (also known as "Config Point"). You can set the values of parameters in these ways:

Notes:

  • You can see the configuration parameters and their values in Gaia Portal:

    https://<IPv4 Address of Gaia>/param_docs

  • On a Security Gateway, during an upgrade to R82.20 and during each boot of R82.20, Gaia OS automatically:

    1. Transfers the configured kernel parameters (that are not commented out) from the legacy configuration files $FWDIR/boot/modules/fwkern.conf and $PPKDIR/conf/simkern.conf to the centralized database.

      Support for more legacy configuration files is planned for later versions.

    2. Comments out the configured kernel parameters in the legacy configuration files (adds the # character in the beginning of the line and adds the corresponding command at the end of the line).

  • On a Security Gateway, if a kernel parameter value is already configured in the centralized database, and you configure a value for the same kernel parameter in the legacy configuration file, then during the next boot, the value from the legacy configuration file overrides the previous value in the centralized database.

Legacy

Configuration Files

This method changes the value of the Check Point kernel parameter on a Security Gateway in one of the legacy configuration files as done in R81.20 and lower.

For example, you configure kernel parameters in these files:

  • $FWDIR/boot/modules/fwkern.conf

  • $PPKDIR/conf/simkern.conf

Use these CLI commands (in Gaia Clish or the Expert mode) to configure kernel parameters:

  • fw ctl get int ...

  • fw ctl get str ...

  • fw ctl set [-f] int ...

  • fw ctl set [-f] str ...

For the complete legacy procedure to configure kernel parameters, see the R82.10 Security Gateway Guide > Chapter "Working with Kernel Parameters".

Managing Permission of Gaia Users to Edit Configuration Parameters

By default, only a Gaia user with the adminRole can edit configuration parameters. A user with the monitorRole can view the configuration parameters. You can add a Read Only or Read / Write feature permissions to other roles so that they can view and edit parameters.

Feature Permissions for (Undefined variable: Vars_BladesFeatures.tp_unified_configuration)

Feature name in
Gaia Portal

Feature name in Gaia Clish

Description

Advanced Configuration

sysconfig

Set the value of Unified Configuration global parameters in Gaia Portal.

param

param

Set the value of Unified Configuration global parameters in Gaia Clish.

param (REST API)

expert_api_param

Set the value of Unified Configuration global parameters in Gaia RESTful API.

For more information about managing Gaia roles, see:

Set Values of Configuration Parameters in Gaia Portal

In Gaia Portal, you can set values of configurations in the Advanced Configuration menu. Parameters appear in a table in the center of the menu. These are the kinds of parameter:

  • Integer

  • String

  • Boolean

  • Select List (a single value you select from a dropdown menu)

  • Type List (a list of values that you enter in a popup window)

To open the Advanced Configuration menu:

In Gaia Portal, in the navigation tree, click System Management > Advanced Configuration

To search for a parameter:

Enter a string into the search bar above the table and

To filter the parameters that appear in the table by feature:

In the left navigation tree, select a feature. For example: Identity Awareness > AD Query

To filter the parameters that appear in the table by status:

In the top toolbar, select one of these:

  • All - Shows all parameters.

  • Changed - Shows the parameters that were edited and saved most recently.

  • Unsaved - Shows parameters that you edited in your current session but did not save.

  • Pending - Shows parameters that were edited and saved, but the changes did not yet take effect. For example, parameters that require restart of the Check Point Firewall or that require policy installation from the Management Server to the Check Point Firewall.

To set the value of a parameter:

  1. In the parameter's table row, in the Value column, select or enter a value.

    Note - For a Type List parameter, in the Value column, in the white box, click Open List. In the window that opens, add a list of values.

    After you set the value of the parameter, the parameter appears in the results of the Unsaved filter. The changes are not saved in the Gaia database and do not take effect.

  2. Save the changes:

    1. Select the checkbox to the left of the Path of parameters that you changed and want to save.

    2. Click Save.

      The new value of the parameter is saved in the Gaia database. The parameter appears in the results of the Changed filter.

      If additional action is required for the change to take effect, the parameter appears in the results of the Pending filter. In the results of the Pending filter, the Pending For column shows the required action for the change to take effect (for example, re-start the Check Point Firewall, policy installationthe Management Server to the Check Point Firewall).

To undo unsaved changes to parameters that you made during your user session:

  1. Select the checkbox to the left of the Path of the parameter(s).

  2. Click Undo Changes.

    The value of the parameter in the editor changes to its value at the beginning of your user session. There is no effect on the value of the parameter in the Gaia database.

To restore parameters to their default values:

  1. Select the checkbox to the left of the Path of the parameter(s).

  2. Click Revert > Revert to default value.

  3. In the window that opens, click Revert.

    The parameter(s) revert to their default value(s). The changes are saved to the Gaia database automatically.

To restore parameters to their last saved values:

  1. Select the checkbox to the left of the Path of the parameter(s).

  2. Click Revert > Revert to last saved value.

  3. In the window that opens, click Revert.

    The value(s) of the parameter(s) revert to their last saved value(s). The changes are saved to the Gaia database automatically.

To open an audit log of changes to parameters:

In the toolbar above the table, click Auditing.

To open the Unified Configuration Reference from the Advanced Configuration page in Gaia Portal:

In the toolbar above the table, click Configuration Reference. For more information about the Configuration Reference, see View Configuration Parameters in the Unified Configuration Reference

View Configuration Parameters in the Unified Configuration Reference

You can see the information about the configuration parameters and their values in the Unified Configuration Reference on your Gaia server.

With a web browser, connect to:

https://<IPv4 Address of Gaia/param_docs

  • In the left panel, click the applicable parameter category.

  • In the right panel:

    • At the top left, you can filter the list of parameters by their name and path.

    • At the top right, you can export the parameters as a CSV file.

      If you filtered the list of parameters, this file saves only the parameters that you see on the page.

    • Click anywhere in the parameter row to see its information:

      • Parameter Name and Path

      • Parameter Description

      • Type and Valid Values

      • Default Value

      • Pending the Action

      • Supported Platforms

      • VSNext / Traditional VSX

CLI Syntax to View Configuration Parameters in Gaia Clish / Gaia gClish

Notes:

  • On a VSNext Security Group / Traditional VSX Gateway, you must go to the context of the of the applicable Virtual Gateway / Virtual System:

    set virtual-system <ID>

  • The command "show param" does not show the kernel parameters configured in the legacy configuration files.

show param all

      [filter-by]

            modified

                  [format {json | yaml | table} [verbose-level <0-3>]]

            not-default

                  [format {json | yaml | table} [verbose-level <0-3>]]

            with-comments

                  [format {json | yaml | table} [verbose-level <0-3>]]

      [format {json | yaml | table} [verbose-level <0-3>]]

show param path {<Full Parameter Path in DB> | <Path with Wildcards in DB>}

      [field]

            comments

            description

            default_value

            pending_value

      [filter-by]

            modified

                  [format {json | yaml | table} [verbose-level <0-3>]]

            not-default

                  [format {json | yaml | table} [verbose-level <0-3>]]

            with-comments

                  [format {json | yaml | table} [verbose-level <0-3>]]

      [format {json | yaml | table} [verbose-level <0-3>]]

      [key <Path of Parameter Key>]

Parameter

Description

show param all

Shows all configuration parameters with values, descriptions, and comments.

show param path <Path in DB>

Specifies the path of a configuration parameter in the database:

  • <Full Parameter Path in DB>

    Shows the configuration parameter based on its full path in the database.

  • <Path with Wildcards in DB>

    Shows the configuration parameters based on the specified path with wildcards "*" in the database:

    1. Enter the relevant path characters (at least 2 characters).

    2. Enter the * character in the relevant place.

    3. If needed, enter the relevant path characters.

    4. Press the Space key.

    5. Enter the sub-command "use-regex true".

    6. Press the Tab key to see the next available sub-command.

field

Specifies which fields to show for the configuration parameter(s):

  • comments

    Shows only the comment (shows "null" if there is no comment configured).

  • description

    Shows only the description.

  • default_value

    Shows only the default value.

  • pending_value

    Shows only the pending value (shows "null" if there is no such value configured).

filter-by

Specifies a filter for the output:

  • modified

    Shows configuration parameters, whose values were configured explicitly.

  • not-default

    Shows configuration parameters, whose values are not default.

  • with-comments

    Shows configuration parameters with configured comments.

format {json | yaml | table}

Specifies the output format:

  • json

    JSON.

  • yaml

    YAML.

  • table

    Table (this is the default).

verbose-level <0-3>

Specifies the verbose level for the JSON and YAML formats:

  • 0

    Simplified format (this is the default).

    • The parameter path.

    • The current value.

  • 1

    Standard format with basic details.

    • The parameter path.

    • The current value.

    • The default value.

  • 2

    Advanced format with more details.

    • The parameter path.

    • The current value.

    • The default value.

    • The pending value and the required action.

    • The comment.

  • 3

    Detailed format (all information).

    • The parameter path.

    • The current value.

    • The default value.

    • The pending value and the required action.

    • The comment.

    • The description.

    • The "last modified" information (username, time and state, previous value).

    • The Virtual System ID:

      • In the Gateway mode, the value is always 0.

      • In the VSNext / Traditional VSX mode, the value is the applicable ID.

key <Path of Parameter Key>

Specifies the internal key path for the specific key.

Example: Enter "name[eth0].ipaddr" to get the IP address of the interface "eth0".

CLI Syntax to Configure Configuration Parameters in Gaia Clish / Gaia gClish

Notes:

  • On a VSNext Security Group / Traditional VSX Gateway, you must go to the context of the of the applicable Virtual Gateway / Virtual System:

    set virtual-system <ID>

  • The "set param" command saves the change automatically.

    You do not need to run the "save config" command.

set param path <Parameter Path in DB>

      comment "Comment Text"

      key <Key Path> key-value <Key Value>

      param-value <Parameter Value>

            comment "Comment Text" use-regex {true | false} dry-run {true | false}

            use-regex {true | false} dry-run {true | false}

            volatile true use-regex {true | false} dry-run {true | false}

      use-default {true | false}

            comment "Comment Text" use-regex {true | false} dry-run {true | false}

            use-regex {true | false} dry-run {true | false}

            volatile true use-regex {true | false} dry-run {true | false}

      volatile {true | false} use-regex {true | false} dry-run {true | false}

Parameter

Description

set param path <Parameter Path in DB>

Configures the configuration parameter settings in the database.

You must specify one of these paths for the configuration parameter:

  • The full path in the database.

  • The path with wildcards "*" in the database:

    1. Enter the relevant path characters (at least 2 characters).

    2. Enter the * character in the relevant place.

    3. If needed, enter the relevant path characters.

    4. Press the Space key.

    5. Enter the sub-command "use-regex true".

    6. Press the Tab key to see the next available sub-command.

comment "Comment Text"

Configures the comment text (up to 256 characters) for the specified configuration parameter(s).

key <Key Path> key-value <Key Value>

Configures the key in the parameter (if this parameter contains keys).

  • key <Key Path>

    Specifies the internal key path for the specific key.

  • key-value <Key Value>

    Based on the key type, the key value can be one of these:

    • An integer.

      Theoretical example:

      set param path gaia.auth_servers.radius key auth_order key-value 1

    • A boolean.

      Theoretical example:

      set param path gaia.dns1 key use_dns key-value true

    • An ASCII string.

      Theoretical example:

      set param path gaia.dns1 key primary key-value "1.1.1.1"

    • A JSON set.

      Theoretical example:

      set param path gaia.users key name[admin].groups key-value '{"update":[{"name":"gadmin","gid":0}]}'

    • An object.

      Theoretical example:

      set param path gaia.dns1 param-value '{"primary":"1.1.1.1","secondary":"2.2.2.2"}'

param-value <Parameter Value>

Configures a new value for the specified configuration parameter(s).

Different configuration parameters accept different value types:

  • An integer.

  • A boolean (true, false).

  • A string.

The required values are provided in Check Point Support Center and by Check Point Support Engineers.

use-default {true | false}

Specifies whether to configure (true) or not (false) the default value for the specified configuration parameter.

Default: false

volatile {true | false}

Specifies whether to configure the new value only temporarily for the specified configuration parameter:

Important - By default, the new value is configured permanently.

  • volatile true

    Configures the new value for the specified configuration parameter only temporary - until the next reboot, or until you run "volatile false".

    During the next boot, the previous value of the specified configuration parameter is restored.

  • volatile false

    Restores the previous value for the specified configuration parameter after you ran "volatile true".

use-regex {true | false}

Specifies whether the specified configuration parameter's path includes wildcards "*" (true) or not (false).

Default: false

dry-run {true | false}

Specifies whether to save the new value for the specified configuration parameter permanently in the database:

  • dry-run true

    Does not save the new value for the specified configuration parameter - the change does not survive the reboot.

  • dry-run false

    Saves the new value for the specified configuration parameter - the change survives the reboot.