fw up_execute

Description

Executes the offline Unified Policy on the Security Gateway.

You can examine the Security Gateway behavior for the specified traffic in the current Access Control and NAT Policy.

For example, view the reason why a packet was not matched to a specified rule.

Requirement - You must install a user-defined Access Control Policy on the Security Gateway.

This tool:

  1. Creates a packet based on the specified parameters.

  2. Runs the current Access Control and NAT Policy on this packet.

  3. Shows all the classification information.

Note - You can also use the Gaia API v1.8 call "simulate-packet". See the Check Point Gaia API Reference.

This command only supports:

  • Source IP address, Destination IP address, and objects that contain an IP address.

  • Simple services objects (based on a destination port, source port, and protocol).

  • Protocol detection.

  • Application detection.

  • First packet match.

    Explanation:

    The Security Gateway must inspect several data packets to determine an application or an involved data protocol.

    If it is necessary to simulate a packet from an application or a data protocol, you must specify these explicitly in the syntax.

  • TCP v4 and TCP v6 traffic (protocol #6).

  • UDP v4 and UDP v6 traffic (protocol #17).

  • ICMP v4 and ICMPv6 traffic (protocol #1).

  • Security Zone.

  • Access Roles.

  • Domain Objects.

  • Updatable Objects.

  • Other Service, only if:

    • In the IP Protocol field, you configured the number of the supported protocols (TCP - 6, UDP - 17, ICMP - 1).

    • You did not configure a Match expression (on the Advanced page).

  • Time Objects.

Limitations:

  • These are not supported: DCE-RPC service, Content Awareness Software Blade, VPN traffic, Resource object, Mobile Access applications.

  • NAT64 rules are not supported

  • NAT46 rules are not supported

  • CGNAT settings are not supported

  • When you run the tool in the NAT policy mode, the tool ignores the checkbox "Disable NAT inside the VPN community" in the VPN Community objects.

Important:

  • You can run this command in the Expert mode or in Gaia Clish (Gaia gClish on Scalable Platforms).

  • On Scalable Platforms (ElasticXL, Maestro, and Chassis), you must connect to the Gaia Portal of the applicable Security Group.

Syntax for an Access Control Rule for TCP / UDP traffic

fw [-d] up_execute mode=access in_ifn=<Name of Interface> ipp={6 | 11} src=<Source IP> dst=<Destination IP> [sport=<Source Port>] dport=<Destination Port> [protocol=<Protocol Detection Name>] [application="<Application/Category Name 1>" [application="<Application/Category Name 2>" ...]] [access_rule_search_uid=<Rule UID>

Syntax for an Access Control Rule for ICMP traffic

fw [-d] up_execute mode=access in_ifn=<Name of Interface> ipp={1 | 58} src=<Source IP> dst=<Destination IP> type=<ICMP Type> code=<ICMP Code> [protocol=<Protocol Detection Name>] [application="<Application/Category Name 1>" [application="<Application/Category Name 2>" ...]] [access_rule_search_uid=<Rule UID>

Syntax for a NAT Rule

fw [-d] up_execute mode=nat in_ifn=<Name of Interface> ipp=<IANA Protocol Number> src=<Source IP> dst=<Destination IP> [sport=<Source Port>] dport=<Destination Port>

Note - For IPv6, use the "fw6 up_execute <parameters>" command.

Parameters

The order of the parameters does not matter.

Parameter

Description

No Parameters

Shows the built-in usage.

-d

Runs the command in debug mode.

Use only if you troubleshoot the command itself.

Best Practice - If you use this parameter, then redirect the output to a file, or use the script command to save the entire CLI session.

To see more information, run:

TDERROR_ALL_ALL=5 fw -d <parameters>

mode=<Rule Mode>

Specifies the rule mode:

  • mode=access - This is an Access Control rule (this is the default mode).

  • mode=nat - This is a NAT rule.

in_ifn=<Name of Interface>

Specifies the name of the interface:

  • To simulate inbound traffic to the Security Gateway, enter the name of the interface (example: in_ifn=eth2).

  • To simulate outbound traffic from the Security Gateway, enter "in_ifn=localhost".

ipp=<IANA Protocol Number>

Specifies the IANA Protocol Number in the Hexadecimal format.

Supported protocols:

  • TCP: ipp=6

  • UDP: ipp=17

  • ICMP v4: ipp=1

  • ICMP v6: ipp=58

See IANA Protocol Numbers.

src=<Source IP>

Optional parameter.

Specifies the Source IP address.

Default value: 12345.

dst=<Destination IP>

Specifies the Destination IP address.

sport=<Source Port>

Specifies the Source Port number in the Decimal format.

See IANA Service Name and Port Number Registry.

dport=<Destination Port>

Specifies the Destination Port number in the Decimal format.

See IANA Service Name and Port Number Registry.

type=<ICMP Type> code=<ICMP Code>

Specifies the ICMP Type and ICMP Code.

For ICMPv4, only these pairs are supported:

  • type=8 code=0 - Echo Request

  • type=0 code=0 - Echo Reply

For ICMPv6:

  • Types 1, 2, 3, 4, and 137 are not supported

protocol=<Protocol Detection Name>

Optional parameter.

Specifies the protocol detection name (HTTP, HTTPS, and so on), if the "Protocol Signature" option is enabled in the applicable service.

application="<Application/Category Name>"

Optional parameter.

Specifies the name of the Application/Category as defined in SmartConsole.

You can specify multiple applications.

If the Application/Category name contains spaces, you must enclose it in double quotes (example: application="Google Docs").

access_rule_search_uid=<Rule UID>

Specifies the UID of an Access Control rule to examine why the packet did not match this rule.

In the Access Control policy, in the applicable rule, right-click the No. column and click Copy Rule UID.

Syntax Examples:

fw up_execute mode=access in_ifn=eth0 ipp=6 src=2.2.2.2 dst=1.1.1.1 dport=80 application="Facebook"

fw up_execute mode=access in_ifn=eth1 ipp=1 src=10.0.0.7 dst=1.1.1.1 type=8 code=0

fw6 up_execute mode=access in_ifn=eth1 ipp=6 src=1::7:7 dst=1::1 dport=443

fw up_execute mode=nat in_ifn=eth1 ipp=6 src=10.0.0.8 dst=1.1.1.1 dport=443

Example Outputs

Example Access Control Policy - Network Layer:

No

Source

Destination

VPN

Services & Applications

Action

Track

Install On

1

United States

MyServer

Any

https

http

Accept

None

Policy Targets

2

MyClient

MyNetwork

Any

ssh

Drop

None

Policy Targets

3

.checkpoint.com

Any

Any

Any

Accept

Log

Policy Targets

4

Any

Any

Any

Any

Accept

None

Policy Targets

Example Access Control Policy - Application Control Layer):

No

Source

Destination

VPN

Services & Applications

Action

Track

Install On

1

MyNetwork

Internet

Any

Facebook

Drop

None

Policy Targets

2

MyNetwork

Internet

Any

Social Networking

Drop

None

Policy Targets

3

Any

Internet

Any

Any

Accept

None

Policy Targets

Example NAT Policy:

No

Original Source

Original Destination

Original Services

Translated Source

Translated Destination

Translated Services

Install On

1

MyClient

MyServer

Any

H MyClient_NAT_IP

S MyServer_NAT_IP

= Original

Policy Targets

2

MyDNS1

Any

Any

= Original

= Original

= Original

Policy Targets

Where:

  • United States = An Updatable object

  • MyServer = A Host object with IPv4 10.10.10.1

  • MyServer_NAT_IP = A Host object with IPv4 194.1.1.1

  • MyClient = A Host object with IPv4 192.168.1.1

  • MyClient_NAT_IP = A Host object with IPv4 172.16.4.1

  • MyNetwork = A Network object with IPv4 172.29.113.200

  • .checkpoint.com = A Domain object

Output Example 1 - Access Control - incoming traffic is matched to a user-defined rule

[Expert@MyGW:0]# fw up_execute mode=access in_ifn=eth0 ipp=6 src=209.87.209.100 dst=10.10.10.1 dport=443

Rulebase execution ended successfully.
Overall status:
----------------
Match status: MATCH
Match action: Accept
Object types required for matching: None
Object types required for logging: None

Per Layer:
------------
Layer name: Network
Layer uuid: xxx-xxx-xxx-xxx-xxx
Layer id: 0
Match status: MATCH
Match action: Accept
Matched rule: 1
Matched rule uuid: xxx-xxx-xxx-xxx-xxx
Possible rules:  1 3 4

Reported clobs:
------------
Type 4 (SERVICE):
        https [xxx-xxx-xxx-xxx]
Type 7 (SOURCE_ACCESS_ROLE):
        Unknown [xxx-xxx-xxx-xxx]
Type 8 (DESTINATION_ACCESS_ROLE):
        Unknown [xxx-xxx-xxx-xxx]
Type 17 (SOURCE_DYNOBJ):
        CP_GEO_US [xxx-xxx-xxx-xxx]
Type 29 (MAB_APPLICATION):
        Unknown [xxx-xxx-xxx-xxx]
Type 32 (SOURCE_FQDN_DOMAIN):
        .checkpoint.com [xxx-xxx-xxx-xxx]
[Expert@MyGW:0]#

Output Example 2 - Access Control - outgoing traffic is matched to an implied rule

[Expert@MyGW:0]# fw up_execute mode=access in_ifn=localhost ipp=6 src=172.29.113.201 dst=10.10.10.1 dport=443

Rulebase execution ended successfully.
Overall status:
----------------
Match status: MATCH
Match action: Accept
Object types required for matching: None
Object types required for logging: None

Per Layer:
------------
Layer name: Network
Layer uuid: xxx-xxx-xxx-xxx-xxx
Layer id: 0
Match status: Override by implied rule before last: accept_outgoing (id 69)
Match action: Accept

Reported clobs:
------------
Type 1 (APPLICATION):
        Unknown Traffic [xxx-xxx-xxx-xxx]
                Unknown Traffic (appi category) [xxx-xxx-xxx-xxx]
                Unknown Traffic (urlf category) [xxx-xxx-xxx-xxx]
Type 4 (SERVICE):
        https [xxx-xxx-xxx-xxx]
Type 7 (SOURCE_ACCESS_ROLE):
        Unknown [xxx-xxx-xxx-xxx]
Type 8 (DESTINATION_ACCESS_ROLE):
        Unknown [xxx-xxx-xxx-xxx]
Type 29 (MAB_APPLICATION):
        Unknown [xxx-xxx-xxx-xxx]
Type 32 (SOURCE_FQDN_DOMAIN):
        Unknown [xxx-xxx-xxx-xxx]
Type 41 (FILE):
        Unknown [xxx-xxx-xxx-xxx]
Type 42 (CONTENT):
        Unknown [xxx-xxx-xxx-xxx]
[Expert@MyGW:0]#

Output Example 3 - Access Control - incoming traffic is matched to a user-defined rule

[Expert@MyGW:0]# fw up_execute mode=access in_ifn=eth1 ipp=6 src=192.168.1.1 dst=157.240.252.35 dport=443 application="Facebook"

Rulebase execution ended successfully.
Overall status:
----------------
Match status: MATCH
Match action: Drop
Object types required for matching: None
Object types required for logging: None

Per Layer:
------------
Layer name: Network
Layer uuid: xxx-xxx-xxx-xxx-xxx
Layer id: 0
Match status: MATCH
Match action: Accept
Matched rule: 4
Matched rule uuid: xxx-xxx-xxx-xxx-xxx
Possible rules:  4

Layer name: Application Control
Layer uuid: xxx-xxx-xxx-xxx-xxx
Layer id: 1
Match status: MATCH
Match action: Drop
Matched rule: 1
Matched rule uuid: xxx-xxx-xxx-xxx-xxx
Possible rules:  1 2 3

Reported clobs:
------------
Type 1 (APPLICATION):
        Facebook [xxx-xxx-xxx-xxx]
                Social Networking (appi category) [xxx-xxx-xxx-xxx]
                Low Risk (urlf category) [xxx-xxx-xxx-xxx]
                Social Networking (urlf category) [xxx-xxx-xxx-xxx]
Type 4 (SERVICE):
        https [xxx-xxx-xxx-xxx]
        cp_tcp_XXX_XXX_XXX_XXX_XXX [xxx-xxx-xxx-xxx]
Type 7 (SOURCE_ACCESS_ROLE):
        Unknown [xxx-xxx-xxx-xxx]
Type 8 (DESTINATION_ACCESS_ROLE):
        Unknown [xxx-xxx-xxx-xxx]
Type 29 (MAB_APPLICATION):
        Unknown [xxx-xxx-xxx-xxx]
Type 32 (SOURCE_FQDN_DOMAIN):
        Unknown [xxx-xxx-xxx-xxx]
[Expert@MyGW:0]#

Output Example 4 - Access Control - viewing the reason why a packet was not matched to a specified rule (rule #1 in the Network Layer in our example)

[Expert@MyGW:0]# fw up_execute mode=access in_ifn=eth0 ipp=6 src=209.87.209.100 dst=10.10.10.1 dport=123 access_rule_search_uid=ee08d7d8-1283-44e6-934d-3c9db769d826

Rulebase execution ended successfully.
Overall status:
----------------
Match status: MATCH
Match action: Accept
Object types required for matching: None
Object types required for logging: None

Per Layer:
------------
Layer name: Network
Layer uuid: xxx-xxx-xxx-xxx-xxx
Layer id: 0
Match status: MATCH
Match action: Accept
Matched rule: 4
Matched rule uuid: xxx-xxx-xxx-xxx-xxx
Possible rules:  4


Reported clobs:
------------
Type 4 (SERVICE):
        https [xxx-xxx-xxx-xxx-xxx]
        ntp-tcp [xxx-xxx-xxx-xxx-xxx]
Type 17 (SOURCE_DYNOBJ):
        CP_GEO_US [xxx-xxx-xxx-xxx-xxx]
Type 32 (SOURCE_FQDN_DOMAIN):
        Unknown [xxx-xxx-xxx-xxx-xxx]


******************************************************************************************************************
                Access Control Rulebase Search Result for the Rule UID: ee08d7d8-1283-44e6-934d-3c9db769d826
******************************************************************************************************************

Layer name: Network
Rule number: 1


Search status code : CHECK_ACCESS_RULE_CODE_COLUMN_DIDNT_MATCH
Search status reason : Did not match because of the 'Service Application' column


Objects in that column:
                'http'
                'https'

Object types in column:
                'SERVICE_APPLICATION'

Is column negated? no


[Expert@MyGW:0]#

Output Example 5 - NAT - incoming traffic is matched to a user-defined rule

[Expert@MyGW:0]# fw up_execute mode=nat in_ifn=eth0 ipp=6 src=192.168.1.1 dst=10.10.10.1 dport=443

NAT rulebase execution ended successfully.

Matched rule: 1
Matched rule's uuid: xxx-xxx-xxx-xxx-xxx
Possible rules:  1
Connection after NAT: <dir 0, 172.16.4.1:100001 -> 194.1.1.1:443 IPP 6>
Nat decisions:
-----------------
Server side Hide translation on Source (192.168.1.1)->(172.16.4.1)
Server side Hide translation on Source Port (12345)->(10001)
Server side Hide translation on Destination (10.10.10.1)->(194.1.1.1)
[Expert@MyGW:0]#