Global Commands on Security Groups

The Gaia operating system includes a set of global commands that apply to all or specified Security Group Members.

Working with Global Commands

Background

  • Gaia gClish commands apply globally to all Security Group Members, by default.

  • Gaia gClish commands do not apply to Security Group Members that are in the DOWN state in the Security Group.

    If you run a "set" command while a Security Group Member is in the DOWN state, the command does not update that Security Group Member.

    The Security Group Member synchronizes its database during startup and applies the changes after reboot.

  • Gaia Clish commands apply only to the specific Security Group Member.

    See the R82 Gaia Administration Guide.

Gaia Global Commands

Global operating system commands are standard Linux commands that run on all or specified Security Group Members.

When you run a global command in Gaia gClish, the operating system runs a global script that is the standard Linux command on the Security Group Members.

When you run a command in the Expert mode, it works as a standard Linux command.

To use the global command in the Expert mode, run the global command script version as shown in this table:

Gaia gClish Command

Global Command in the Expert mode

arp

g_arp

g_allc arp

cat

g_cat

cp

g_cp

dmesg

g_dmesg

ethtool

g_ethtool

ifconfig

asg_ifconfig

ls

g_ls

md5sum

g_md5sum

mv

g_mv

netstat

g_netstat

reboot

g_reboot

tail

g_tail

tcpdump

g_tcpdump

top

g_top

Notes:

  • The parameters and options for the standard Linux command are available for the global command.

  • You can use one or more flags.

  • Do not use these two flags together in the same command:

    • The "-l" flag - to execute the command only on the local Security Group Member

    • The "-r" flag - to execute the command only on the remote Security Group Member

Syntax

  • In Gaia Clish:

    <Gaia gClish Command> [-b <SGM IDs>] <Command Options>]

  • In the Expert mode:

    <Global Expert mode Command> [-b <SGM IDs>] <Command Options>]

Parameters

Parameter

Description

<Gaia gClish Command>

Standard command in Gaia gClish as appears in the table above.

<Global Expert mode Command>

Global command in the Expert mode as appears in the table above.

-b <SGM IDs>

Applies to Security Group Members as specified by the <SGM IDs>.

<SGM IDs> can be:

  • No <SGM IDs> specified, or all

    Applies to all Security Group Members and all Sites

  • One Security Group Member (for example, 1_1)

  • A comma-separated list of Security Group Members (for example, 1_1,1_4)

  • A range of Security Group Members (for example, 1_1-1_4)

  • One Site (chassis1, or chassis2)

  • The Active Site (chassis_active)

Note - You can only select Security Group Members from one Site with this option.

<Command Options>

Standard command options for the specified command.

Below are explanations about some of the global commands.

Description

The global ls command shows the file in the specified directory on all Security Group Members.

Syntax

  • In Gaia Clish:

    ls [-b <SGM IDs>] <Command Options>]

  • In the Expert mode:

    g_ls [-b <SGM IDs>] <Command Options>]

Example

This example runs the 'g_ls' command in the Expert mode on Security Group Members 1_1, 1_2, and 1_3.

The example output shows the combined results for these Security Group Members.

[Expert@SG-s01-01:0]# g_ls -b 1_1-1_3,2_1 /var/
-*- 4 blades: 1_01 1_02 1_03 -*-
CPbackup    ace    crash  lib   log   opt       run    suroot
CPsnapshot  cache  empty  lock  mail  preserve  spool  tmp
[Expert@SG-s01-01:0]#

Description

The global reboot command reboots all Security Group Members.

Syntax

  • In Gaia Clish:

    reboot [-a]

  • In the Expert mode:

    g_reboot [-a]

Parameters

Parameter

Description

No Parameters

Reboots all Security Group Members that are in the state "UP".

-a

Reboots all Security Group Members that in the DOWN and the UP states.

Description

The global top command:

  • Shows CPU utilization in real time on Security Group Members.

  • Uses the local Security Group Member configuration file (~/.toprc) to format the output on the remote Security Group Members.

    The command copies this file to the remote Security Group Members.

Syntax

  • In Gaia gClish:

    top -h

    top [local] [-f [-o <Output File>] [-n <Number of Iterations>]] -b <SGM IDs> [<Command Options>]

    top [local] [s <Output File>] -b <SGM IDs> [<Command Options>]

  • In the Expert mode:

    g_top -h

    g_top [local] [-f [-o <Output File>] [-n <Number of Iterations>]] -b <SGM IDs> [<Command Options>]

    g_top [local] [s <Output File>] -b <SGM IDs> [<Command Options>]

Parameters

Parameter

Description

-h

Shows the built-in help.

local

Uses the 'top' configuration file (~/.toprc) on the local Security Group Member.

-f

Exports the output to a file.

Default: /vat/log/gtop.<Time>

-o <Output File>

Specifies the path and name of the output file.

Must use with the "-f" parameter.

-n <Number of Iterations>

The command saves the output the specified number of times.

Default: 1

Must use with the "-f" parameter.

-s <Output File>

Shows the content of the output file <Output File>, in which the command saved its output earlier.

<Command Options>

Parameters of the standard top command.

For more information, see the top command documentation.

Configuring the 'g_top' output

Step

Instructions

1

Connect to the command line on the Security Group.

2

 Log in to the Expert mode.

3

Run:

top

4

Set the desired view (press h to see the built-in help).

5

Press Shift+W to save the 'top' configuration.

6

Run:

g_top

Description

The global arp command shows the ARP cache table on all Security Group Members.

Syntax

  • In Gaia Clish:

    arp [-b <SGM IDs>] <Command Options>]

  • In the Expert mode:

    g_arp [-b <SGM IDs>] <Command Options>]

Example - ARP table on all interfaces of all Security Group Members

[Expert@SG-s01-01:0]# gclish
[Global] SG-s01-01 > arp
1_01:
Address     HWtype  HWaddress           Flags Mask   Iface
192.0.2.2   ether   00:1C:7F:02:04:FE   C            Sync
172.23.9.28 ether   00:14:22:09:D2:22   C            eth1-Mgmt4
192.0.2.3   ether   00:1C:7F:03:04:FE   C            Sync
1_02:
Address     HWtype  HWaddress           Flags Mask   Iface
192.0.2.3   ether   00:1C:7F:03:04:FE   C            Sync
172.23.9.28 ether   00:14:22:09:D2:22   C            eth1-Mgmt4
192.0.2.1   ether   00:1C:7F:01:04:FE   C            Sync
1_03:
Address     HWtype  HWaddress           Flags Mask   Iface
192.0.2.1   ether   00:1C:7F:01:04:FE   C            Sync
172.23.9.28 ether   00:14:22:09:D2:22   C            eth1-Mgmt4
192.0.2.2   ether   00:1C:7F:02:04:FE   C            Sync
[Global] SG-s01-01 >

Check Point Global Commands

These global commands apply to more than one Security Group Member. These global commands let you work with Security Gateway and SecureXL.

Description

The fw and fw6 commands are global scripts that run the fw and fw6 commands on each Security Group Member.

Syntax

Shell

Syntax

Gaia Clish

Gaia gClish

fw

fw6

Expert mode

g_fw

g_fw6

Examples

[Expert@SG-s01-01:0]# gclish
[Global] SG-s01-01> fw ctl
-*- 2 blades: 1_01 1_02 -*-
 Usage: fw ctl command args...
 Commands: install, uninstall, pstat, iflist, arp, debug, kdebug, bench
    chain, conn, multik, conntab, fwghtab_bl_stats
[Global] SG-s01-01 >
 
[Expert@SG-s01-01:0]# gclish
[Global] SG-s01-01> fw ctl iflist
-*- 6 blades: 1_01 1_02 1_03 2_01 2_02 2_03 -*-
0 : BPEth0
1 : BPEth1
2 : eth1-Mgmt4
3 : eth2-Mgmt4
4 : eth1-01
5 : eth1-CIN
6 : eth2-CIN
8 : eth2-01
16 : Sync
17 : eth1-Mgmt1
18 : eth2-Mgmt1
[Global] SG-s01-01 >

Description

Use the "fw dbgfile" commands in Gaia gClish to debug how the Security Group inspect traffic.

Syntax to collect the debug

fw dbgfile collect -f <Debug Output File> [-buf <Buffer Size>] [-m <Debug Module 1><Debug Flags 1> [-m <Debug Module 2><Debug Flags 2>] ... [-m <Debug Module N><Debug Flags N>]]

Syntax to show the collected debug

fw dbgfile view [<Debug Output File>] [-o <Debug Output File>]

Parameters

Parameter

Description

collect

Collects the Security Gateway debug information.

view

Shows the collected debug information.

<Debug Output File>

Specifies the full path and the name of the debug output file.

-buf <Buffer Size>

Specifies the debug buffer size.

Always set the maximal size 8200.

-m <Debug Module 1> Debug Flags 1>
[-m <Debug Module 2> <Debug Flags 2>]
...
[-m <Debug Module N> <Debug Flags N>]

Specifies Security Gateway debug modules and debug flags in those modules.

You can specify more than one debug module.

-o <Debug Output File>

Specifies the full path and the name of the debug output file to read.

Examples

[Global] SG-s01-01 > fw dbgfile collect -f /var/log/debug.txt -buf 8200 -m fw + conn -m kiss + pmdump

[Global] SG-s01-01 > fw dbgfile view /var/log/debug.txt

Important - For complete debug procedure, see the R82 Quantum Security Gateway Guide > Chapter Kernel Debug on Security Groups.

Description

The fwaccel commands control the acceleration for IPv4 traffic.

The fwaccel6 commands control the acceleration for IPv6 traffic.

Syntax

Shell

Syntax for IPv4

Syntax for IPv6

Gaia Clish

Gaia gClish

fwaccel help

fwaccel6 help

Expert mode

g_fwaccel help

g_fwaccel6 help

Parameters and Options

For more information, see the R82 Performance Tuning Administration Guide > Chapter SecureXL > Section SecureXL Commands and Debug - Subsection 'fwaccel' and 'fwaccel6'.