Firewall / IPS / IDS Configuration Tips and Tricks and more..

vg_splat-lv_current 100%, Resize Checkpoint Firewall’s Disk/Partition Space (Gaia and Splat Platform)

noreply@blogger.com (Mohana Kumar Siramdasu) — Wed, 09 May 2018 06:02:00 +0000

Resize Checkpoint Firewall’s Disk/Partition Space (Gaia and Splat Platform)

Published August 24, 2014 by john

Checkpoint Firewall Appliances are using Logical Volume Manager (LVM)

Sometimes, the logic volume do not have enough size to perform your operations. Checkpoint Expert Mode have some commands to modify the volume size while keeping your data on the disk.

1. Check volume size in the volume group vg_splat

[Expert@gw-a9533e:0]# lvs
/dev/hdc: open failed: No medium found
LV         VG       Attr   LSize Origin Snap% Move Log Copy%
lv_current vg_splat -wi-ao 5.00G
lv_log     vg_splat -wi-ao 3.00G

From dh -h command it shows 97% usage on the system volume vg_splat-lv_current. R77.10 will not allow you to operation the firewall if it found insufficient disk space with the warning “there is insufficient disk space to complete the operation’

[Expert@gw-a9533e:0]# df -h
Filesystem            Size Used Avail Use% Mounted on
/dev/mapper/vg_splat-lv_current
                      4.9G 4.8G 52M  97% /
/dev/sda1             289M   24M 251M   9% /boot
tmpfs                 980M     0 980M   0% /dev/shm
/dev/mapper/vg_splat-lv_log
                      3.0G 175M 2.6G   7% /var/log

2. Check free space on the disk

[Expert@gw-a9533e:0]# pvs
/dev/hdc: open failed: No medium found
PV VG Fmt Attr PSize PFree
/dev/sda3 vg_splat lvm2 a- 14.69G 6.69G

3. Check how much space assigned to the logical volume

[Expert@gw-a9533e:0]# lvs
/dev/hdc: open failed: No medium found
LV         VG       Attr   LSize Origin Snap% Move Log Copy%
lv_current vg_splat -wi-ao 5.00G
lv_log     vg_splat -wi-ao 3.00G

4. Resize the logic volume from 5G to 11G

[Expert@gw-a9533e:0]# lvresize -L 11G vg_splat/lv_current
/dev/hdc: open failed: No medium found
Extending logical volume lv_current to 11.00 GB
Logical volume lv_current successfully resized

Check the space again with pvs command, there is only 704M free space left
[Expert@gw-a9533e:0]# pvs
/dev/hdc: open failed: No medium found
PV VG Fmt Attr PSize PFree
/dev/sda3 vg_splat lvm2 a- 14.69G 704.00M

[Expert@gw-a9533e:0]# lvs
/dev/hdc: open failed: No medium found
LV         VG       Attr   LSize Origin Snap% Move Log Copy%
lv_current vg_splat -wi-ao 11.00G
lv_log     vg_splat -wi-ao 3.00G

5. Resize the file system

[Expert@gw-a9533e:0]# resize2fs /dev/vg_splat-lv_current
resize2fs 1.39 (29-May-2006)
Filesystem at /dev/vg_splat/lv_current is mounted on /; on-line resizing required
Performing an on-line resize of /dev/vg_splat/lv_current to 2883584 (4k) blocks.
The filesystem on /dev/vg_splat/lv_current is now 2883584 blocks long.

6. Verify with df command

[Expert@gw-a9533e:0]# df -h
Filesystem            Size Used Avail Use% Mounted on
/dev/mapper/vg_splat-lv_current
                       11G 3.8G  6.4G 38% /
/dev/sda1             289M   24M 251M   9% /boot
tmpfs                 980M     0 980M   0% /dev/shm
/dev/mapper/vg_splat-lv_log
                      3.0G 176M 2.6G   7% /var/log

References:

Fortigate FortiOS 5.6 Redundant Internet Connections without SD-WAN

noreply@blogger.com (Mohana Kumar Siramdasu) — Sat, 09 Sep 2017 05:56:00 +0000

The scenario:
ISP 1 is on wan1, your IP is 1.1.1.2, gateway is 1.1.1.1
ISP 2 is on wan2, your IP is 2.2.2.2, gateway is 2.2.2.1
This configuration will be set up in a primary/secondary failover mode, i will not be doing load balancing

1. Setup gateway detection on wan1

This section tells the firewall to ping an IP (in this case, our gateway) repeatedly to see if it's alive or not. For most cable and DSL type connections this will work fine, however if you are interfacing with another ISP's router that may continue responding to pings even if the circuit is down, then consider using an internet IP such as 4.2.2.2 or 8.8.8.8. You can do this on both wan interfaces if you want it to fail both directions.

config router gwdetect
    edit 1
        set interface "wan1"
        set server "1.1.1.1"
    next
end

On newer firmware, this is replaced with link monitoring:

config system link-monitor
    edit "wan1 check"
        set srcintf "wan1"
        set server "1.1.1.1"
        set gateway-ip 1.1.1.1
        set timeout 5
        set recoverytime 1
    next
end

2. Configure your interfaces

Most of this can be done in the web interface, the only critical piece here are the two fail-detect options on wan1. You can also turn on failure detection for wan2 (make sure you add a gwdetect for it as well), however i don't find it necessary here since if both wan1 and wan2 are down then i'm screwed anyways. Note that the fail-detect options are not necessary on newer firmware.

config system interface
    edit "wan1"
        set ip 1.1.1.2 255.255.255.248
        set fail-detect enable
        set fail-detect-option detectserver
    next
    edit "wan2"
        set ip 2.2.2.2 255.255.255.248
    next
end

3. Configure your static routes

These can be done in the web interface, the important piece is to set the distance on wan2 to a higher value than wan1 so that wan1 is always the preferred route

config router static
    edit 1
        set device "wan1"
        set gateway 1.1.1.1
    next
    edit 2
        set device "wan2"
        set distance 20
        set gateway 2.2.2.1
    next
end

4. Configure Policies

This doesn't need to be done in the CLI, you just need to have an internal to wan1 allow/NAT rule, as well as an internal to wan2 allow/NAT rule. It will choose the proper rule based on which port the traffic is being routed through (the active internet connection). In case you want to see it in CLI, here it is:

config firewall policy
    edit 1
        set srcintf "internal"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat enable
    next
    edit 2
        set srcintf "internal"
        set dstintf "wan2"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set nat enable
    next
end

5. Test and confirm

At this point you should be up and running. You can check the status of the gateway detection using get router info gwdetect. You can also check the routing table status using get router info routing-table all.

It is important that when you do your testing you simulate a logical failure of the circuit so your wan1 stays "up". The easy way to do this is to unplug the carrier side of the equipment (unplug the coax for cable, phone line for DSL, T1/loops for T1/EoC/EoDS1, etc.)

6. VPN setup

If you have IPSEC VPN tunnels and want them to also follow the redundancy here, then there is a little more work to do. This is assuming you already have the tunnel set up on wan1. You would just create the tunnel identically on wan2, selecting wan2 as the local interface. Make sure both tunnels have DPD (Dead Peer Detection) turned on.

After setting up the second tunnel, you will add an IPSEC policy from internal to wan2 using the new tunnel configuration. You will of course have to configure the secondary tunnel on the other end as well. After doing this, the VPN should follow the active interface

7. Using VIPs on backup links

One small quirk, if your default route points out wan1 for example, but you want to have servers using Virtual IPs on wan2 while wan1 is still active, you need to do this:

config system settings
  set asymroute enable
end

This is necessary because the Fortigate will think traffic coming in over wan2 is spoofed unless the default route is pointing there. It would be preferable to leave this feature disabled but this is really the only way to accomplish having both circuits live at the same time.

Current Rule number missing / not showing checkpoint

noreply@blogger.com (Mohana Kumar Siramdasu) — Mon, 22 Aug 2011 10:46:00 +0000

To resolve the problem, perform the following:

Select Global Properties -> SmartDashboard Customization tab

Click Configure.

Go to FireWall-1 -> General view.

Select the rulebase_uids_in_log checkbox.

Save the changes and install the Security Policy.

How to configure NTP on Checkpoint Secureplatform / splat

noreply@blogger.com (Mohana Kumar Siramdasu) — Thu, 23 Jun 2011 08:16:00 +0000

NTP is a protocol designed to synchronize the clocks of computers over a network.To configure NTP on SecurePlatform, proceed as follows:Login to the SecurePlatform CLI (Command Line Interface).Access 'Expert Mode'.Run sysconfig.Perform "Time and Date Configuration". Be sure to set your time zone correctly.Quit the sysconfig utility.Type ntp -n Notes:-n switch specifies that you are not using an MD5 secret. If you need to use an MD5 secret, replace -n with the secret. See the syntax section below.is the time between NTP updates measured in seconds. (For example, a polling interval of 5 minutes would be specified as 300 seconds.)The NTP daemon included on SecurePlatform is a client side only process and cannot be used as a time server, only as a relay server.For more information regarding configuration of ntpd (the NTP daemon), refer to the documentation provided at ntp.orgSyntax for NTP:ntp < server2IP> ntp -n < server2IP> (when working without MD5 secret)

where my Checkpoint Data revision files stores on Checkpoint Provider -1 Server

noreply@blogger.com (Mohana Kumar Siramdasu) — Thu, 23 Jun 2011 08:15:00 +0000

In P1 environment, it is nothing but/opt/CPmds-R70/customers/Customer/CPsuite-R70/fw1/conf/db_versions/repository

Checkpoint useful command reference

noreply@blogger.com (Mohana Kumar Siramdasu) — Thu, 23 Jun 2011 08:13:00 +0000

NG COMMAND LINE INTERFACE
(excluding switch options)

SETUP

cpconfig reconfigures an existing VPN-1/Firewall-1 installation

cpstart starts all Check Point applications running on a machine
(invokes fwstart, fgstart, uagstart, etc.)

cpstop stops all Check Point applications running on a machine

fwstart loads the VPN-1/Firewall-1 Module and starts:
VPN-1/Firewall-1 daemon (fwd)
The Management Server (fwm)
VPN-1/Firewall-1 SNMP daemon (snmpd)
The authentication daemons

fwstop kills the following processes:
VPN-1/Firewall-1 daemon (fwd)
The Management Server (fwm)
VPN-1/Firewall-1 SNMP daemon (snmpd)
The authentication daemons
It also unloads the VPN-1/Firewall-1 Module

cp_permission sets up the permissions for CPMI

CONTROL

fw load compiles and installs a Security Policy to the targets VPN-1/
Firewall-1 Modules. This is done in two ways:
1. fw load compiles and installs an Inspection Script (*.pf) file to
the designated VPN-1/Firewall-1 Modules.
2. fw load converts a Rule Base (*.W) file created by the GUI into an
Inspection Script (*.pf) file, then installs it to the
designated VPN-1/Firewall-1 Modules.

fw bload compiles and installs a Security Policy to the targets embedded
VPN-1/Firewall-1 Modules. This is done in one of two ways.
1. fw bload compiles and installs an Inspection Script (*.pf) file to the
Firewall-1 embedded system specified by
targets.
2. fw bload converts a Rule Base (*.W) file created by the GUI
into an Inspection Script (*.pf) file and then compiles and
installs it to the Firewall-1 embedded system specified by
targets.

fw unload uninstalls the currently loaded Inspection Code from selected
targets

fw fetch fetches the Inspection Code from the specified host and installs
it
to the kernel

fw putkey installs a VPN-1/Firewall-1 authentication password on a host.
This password is used to authenticate internal communications
between VPN-1/Firewall-1 Modules and between a Check
Point Module and Management Server. That is, the password
is used to authenticate the control channel the first time
communication is established.

fw dbload downloads the user database and network object information
(for example, encryption keys) to selected targets

MONITOR

cpstat displays the status of target hosts in various formats
(replaces fwstat, fw fgstat, fgate state, etc.)

cpstat_monitor a utility that runs on the Check Point Management Station
which can trigger pre-defined actions when the system
changes its status or when an event has occurred.
This is done by defining limits (or thresholds) on status
Parameters, and actions to be taken.

fw lichosts prints a list of hosts protected by the VPN-1/Firewall-1/n
products. The list of hosts is in the file $FWDIR/database/
fwd.h

fw ver displays the VPN-1/Firewall-1 major version number, the build
number, and a copyright notice

fw sam inhibits (blocks) connections to and from specific IP addresses
without the need to change the Security Policy. The command is
logged

UTILITIES

fw ctl sends control information to the VPN-1/Firewall-1 Kernel Module
pstat displays VPN-1/Firewall-1 internal statistics
iflist displays the IP interfaces known to the kernel by name and
internal number
arp displays ARP proxy table

fw kill sends a signal to a VPN-1/Firewall-1 daemon

fwm the VPN-1/Firewall-1 Management Server in the Client/Server
implementation of the Management Server, and is used for commu-
nicating with the GUI and adding, updating, and removing admini-
strators.

fwell manages Access Lists for Wellfleet (Bay Networks) routers

fw tab displays the content of INSPECT tables on the target hosts in
various formats.

snmp_trap sends an SNMP trap to the specified host. The message may
appear in the command line, or as one in the program input
(stdin)

dynamic_objects specifies an IP address to which the dynamic object will
be resolved on this machine

dbedit edits the objects file on the Management Server

queryDB_util enables searching the object database according to search
parameters

Log File Management

fw log displays the content of Log Files

fw logswitch creates a new Log File. The current Log File is
closed and renamed $FWDIR/log/date.log and a new Log
File with the default name ($FWDIR/log/fw.log) is created

fw logexport exports the Log File to an ASCII file

fw repairlog rebuilds a Log files pointer files. The three files fw.logptr,
fw.loginitial_ptr and fw.logaccount_ptr are recreated from
data in the specified Log file

HIGH AVAILABILITY

cphastart - enables the High Availability feature on the machine. In NT,
this is done when the VPN-1/Firewall-1 Module is started. In
Solaris, the cphastart command is part of the fwstart script

cphastop - disables the High Availability feature on the machine

cphaprob - defines critical processes. When a critical process fails, the
machine is considered to have failed.

cpha_export (Solaris only) writes MAC address information to stdout. If
the output is redirected to a file, it can be
input (stdin) to cpha_import on another
machine.

cpha_import (Solaris only) imports MAC address information from stdin
and updates the machines MAC address
accordingly. The normal procedure is to
redirect stdin to read a file created by
cpha_export on the primary machine

fw hastat displays information about High Availability machines and their
states.

USER DATABASE MANAGEMENT

fw dbimport imports users into the VPN-1/Firewall-1 User Database from
an external file. You can create this file yourself, or use a file
generated by fw dbexport

fw dbexport - exports the VPN-1/Firewall-1 User Database to a file. The
file may be in one of the following formats:
1. the same Usage as the import file for fw dbimport
2. LDIF Usage, which can be imported into an LDAP
Server using ldapmodify

ldapmodify - imports users to an LDAP server. The input file must be in
the LDIF format

fw ldapsearch - queries an LDAP directory and returns the results

fw expdate - changes the expiration date of users (but not templates) in the
VPN-1/Firewall-1 User Database to the date specified by the
first parameter. This change can be optionally applied only to
selected users by specifying the second parameter

Certificates

fw ca putkey distributes the Certificate Authority Key to a Check Point
Module

fw ca genkey - is used to generate the Certificate Authority Key on a
Management Server

fw certify ssl is used to generate a Certificate Authority certificate on a
Check Point Module

fw internalca - enables hybrid authentication mode, which allows the
server to perform IKE key exchange with the clients using
authentication schemes non-interoperable with IKE.

Instructs the Management Server to initiate an Internal CA,
which involves creating an Internal CA database, gener-
ating public and private keys, issuing a certificate and
saving it.

fw ikecrypt - encrypts the password of a SecuRemote user using IKE.
The resulting string must then be stored in the LDAP
database.

fw sic_reset - resets Secure Internal Communication (SIC) on the
Management Server. The user will be prompted before
the operation actually takes place.

This command deletes the internal Certificate Authority,
deletes the Management Server certificate, deletes the
Certificate Revocation List (CRL), and updates the objects
database.

LICENSING

cplic put - is used to install one or more Local licenses. This command
installs a license on a local machine it cannot be performed
remotely.

cplic print - prints details of Check Point licenses on the local machine.
On a Module, this command will print all licenses that are
installed on the local machine both Local and Central
licenses.

cplic del - deletes a single Check Point license on a host. Use it to delete
unwanted evaluation, expired and other licenses. On a Module,
this command will work only for a Local license.

cplic check is used to check whether the license on the machine will allow
a given feature to be used. This command is used mainly for
Technical Support purposes.

cprlic put can be used only from the Management Server, to attach
(install) one or more:
- Central licenses on an NG Module
- Local licenses on the appropriate NG Module
- Version 4.1 licenses on the appropriate version 4.1 Module

cprlic add - is used to add one or more licenses to the license repository
on
the Management Server.

cprlic print - displays the details of Check Point licenses stored in the
license repository on the Management Server

cprlic del used to detach a Central license from an NG Module. This
command deletes the license from the Module. A Central
license remains in the repository an an unattached license.
The license is available for attachment to another Module.
This command can be executed only on a Management
Server.

cprlic rm - removes a license from the license repository on the
Management Server. It can be executed ONLY after the
license was detached using the cprlic del command.
Once the license has been removed from the repository,
it can no longer be used. To re-use it, use the cprlic add
Or cprlic put command.

cprlic get - retrieves all licenses from a Module into the license
repository on the Management Server. Do this to synchronize
the repository with the Module, if NG and version 4.1 Local
licenses were added (or deleted) locally, and hence do not yet
(or still) exist in the license repository. Retrieving licenses
will also delete from the repository Local licenses that do
not exist on the Module.

INSTALLATION MANAGEMENT

cppkg add is used to add an installation package file to the Product
Repository. The package file can be located on a CD or a
local or network drive. Cppkg does not overwrite existing
packages. Only SecureUpdate packages can be added to the
Product Repository.

cppkg delete is used to delete a product package from the repository.

cppkg search - is used to list the contents of the Product Repository. Use
this command to see the product and OS strings required
to install a product package using the cprinstall command,
or to delete a package using the cppkg delete command.

cppkg setroot - is used to create a new repository root directory location,
and to move existing product packages into the new
repository. The default Product Repository location is
created when the Management Server is installed.

cppkg getroot - is used to find out the location of the Product Repository

cprinstall get - is used to obtain details of the products and the Operating
System installed on the specified Module, and to update
the Product Repository database.

cprinstall test - is used to test whether the product can be installed on
the
remote Module. It verifies that the Operating System and
currently installed products are appropriate for the package,
and that there is enough disk space to install the product.

cprinstall install is used to install Check Point products on remote
modules

cprinstall uninstall is used to uninstall products on remote Modules

cprinstall boot is used to boot the remote computer

cprinstall stop is used to stop the operation of other cprinstall commands.
In particular, this command stops the remote installation of
a product even during transfer of files, file extraction,
and pre-installation testing. The operation can be stopped
at any time up to the actual installation.

VPN-1 ACCELERATOR CARD

vpn accel - used for turning on (or off) the accelerator card. When it is
installed, it is enabled by default. You can also check its
status with the command vpn accel stat

lunadiag - a software diagnostics utility specific to the Luna accelerator
card in the Luna package. The utility is documented in the
file lunadiag.txt

VPN COMMANDS

vpn ver - displays the VPN-1 major version number, the build number, and
a copyright notice. Usage and options are the same as for fw ver

vpn debug - debug the VPN-1 daemon

vpn drv - installs the VPN-1 kernel (vpnk) and connects to the Firewall-1
kernel (fwk)

vpn intelrng - displays the status of the Intel RNG (random number
generator). This command is a Windows NT and Windows
2000 only command.

DAEMONS

cpwd_admin - is used to show the status of processes, and to configure
cpwd

cpridstop used to stop cprid

cpridstart - used to start cprid (cprid is independent of cpstart and
cpstop)

FLOODGATE-1 COMMANDS

etmstart - loads the FloodGate Module and starts the FloodGate-1 daemon
(fgd). Also starts the Management Server, provided it is on the
same machine as the FloodGate Module.

etmstop - kills the FloodGate-1 daemon (fgd) and then unloads the
FloodGate Module. Also stops the Management Server,
Provided it is on the same machine as the FloodGate Module.

fgate load - installs a QoS Policy on the specified FloodGate Modules.
If targets is not specified, the QoS Policy is installed on
the local host.

fgate unload - uninstalls a QoS Policy from the specified FloodGate
Modules

fgate fetch - fetches the FloodGate QoS Policy that was last installed on
the local host. You must specify the machine where the
FloodGate QoS Policy is found. Use localhost in case
there is no Management Server or if the Management
Server is down.

fgate stat - displays the status of target hosts in various formats. The
default format displays the following information for each
host: host name, Rule Base (or FloodGate Module) file name,
date and time loaded, and the interface and direction loaded.

fgate ver - displays the FloodGate-1 version number. The version of the
GUI is displayed in the opening screen, and can be viewed
at any time from the Help menu.

fgate kill - sends a signal to a FloodGate-1 daemon

OPSEC COMMANDS

upgrade_fwopsec - upgrades OPSEC configuration information on the
Management Server from pre-NG to NG format, based
on the upgraded Module information. If you have not
changed any of the defaults, then there is no need to
run the upgrade_fwopsec command. However, if you
have changed the defaults, then you should run the
upgrade_fwopsec command.

BOOT SECURITY

fwstop-default - kills VPN-1/Firewall-1 processes and loads the Default
Filter

fwstop-proc - kills VPN-1/Firewall-1 processes but keeps the current
kernel policy. The Security Policy remains loaded in the
kernel, though user mode processes (cpd, fwd, fwm, vpnd,
fwssd) dont work. Logs, kernel traps, resources, all
security server connections will all stop working. The state
of the kernel remains unchanged. Whatever was loaded in
the kernel is kept. Therefore, rules with generic allow/
reject/drop rules, based only on service will continue
working.

control_bootsec enables or disables Boot Security. The command turns
both the Default Filter and the initial policy off or on,
in the correct sequence.

fwboot bootconf use to change IP Forwarding or Default Filter settings.
This command is located in $FWDIR/boot

comp_init_policy u - removes the current initial policy, and ensures that
it wont be generated in the future when cpconfig
is run

comp_init_policy g - generates the initial policy and ensures that it will
be loaded the next time a policy is fetched (at
fwstart, or at next boot, or via the fw fetch localhost
command). After running this command, cpconfig
will add an initial policy when needed.

defaultfilter.boot - installed by default. It allows:
- all outgoing communications
- incoming communications on ports through which there were previous
outgoing communications
- ICMP packets
- broadcast packets

defaultfilter.drop - drops all communications in and out of the gateway
during the period of vulnerability. If the boot process
requires that the gateway communicate with other
hosts, then the drop default Security Policy should not
be used.

fw defaultgen - use to compile the default filter

How to check unwanted Services running in Checkpoint Firewall / SmartCenter Server

noreply@blogger.com (Mohana Kumar Siramdasu) — Thu, 23 Jun 2011 08:09:00 +0000

gsinsc112[admin]# cat $FWDIR/conf/fwauthd.conf
#21 fwssd in.aftpd wait 0
#80 fwssd in.ahttpd wait -2
#513 fwssd in.arlogind wait 0
#25 fwssd in.asmtpd wait 0
#2525 fwssd in.emaild.smtp wait 0
#110 fwssd in.emaild.pop3 wait 0
#23 fwssd in.atelnetd wait 0
#259 fwssd in.aclientd wait 259
10081 fwssd in.lhttpd wait 0
#900 fwssd in.ahclientd wait 900
0 fwssd in.pingd respawn 0
#0 fwssd in.asessiond respawn 0
#0 fwssd in.aufpd respawn 0
0 vpn vpnd respawn 0
#0 fwssd mdq respawn 0
0 stormd stormd respawn 0
0 sds sdsd respawn 0
0 dtps dtpsd respawn 0
0 dtls dtlsd respawn 0

Good Syntax Examples for TCP DUMP command in Linux / Checkpoint Secureplatform

noreply@blogger.com (Mohana Kumar Siramdasu) — Thu, 23 Jun 2011 08:08:00 +0000

TCP Dump
=========
How can I show ALL traffic on a specified interface?

tcpdump -i eth0

Will show ALL traffic on interface eth0.

How can I capture a specified number of packets?

tcpdump -c 20 -i eth0

The -c argument specifies the number of packets to capture. For example, this command will capture 20 packets on the specified interface eth0 and quit:

How do I show the MAC address in the capture?

tcpdump -e -i eth0

This filter will display the MAC address as well as the basic information.
How can I look for the Welchia Worm with TCPDUMP?

tcpdump -tnn -i eth0 "icmp[icmptype]==icmp-echo && icmp[8]==0xAA && icmp[9]==0xAA && icmp[10]==0xAA && icmp[11]==0xAA"

Sure can. Try this script. Keep in mind that your sniffer will need to be located where it can see all traffic on your network for this to be useful.

How can I use TCPDUMP to determine the top talker on my network?

tcpdump -tnn -c 20000 -i eth0 | awk -F "." '{print $1"."$2"."$3"."$4}' | sort | uniq -c | sort -nr | awk ' $1 > 100 '

Depending on how busy your network is, you might want to lower the `-c 20000' (packet count) to fit your needs. This script will capture 20,000 packets and sort by top talkers

Chechpoint Firewall / Smartcenter server - Error "Out of Memory: Killed process ()"

noreply@blogger.com (Mohana Kumar Siramdasu) — Thu, 23 Jun 2011 08:06:00 +0000

These messages may appear in one of the following locations:

* Console

* SmartView Tracker

* messages or dmesg file

If and when encountered, please contact Check Point Support.

"Out of Memory: Killed process ()"

This message appears in the dmesg file and in /var/log/messages files on SecurePlatform.

It means that no more memory is available to Linux in the user space. As a result, Linux starts to kill processes.

"FW-1: Capacity problem detected

Memory consumption has exceeded X%" (Console message)

"Capacity notification: Memory consumption has exceeded X%" (SmartView Tracker message)

These messages indicate that the memory consumption has increased beyond what was defined as the Aggressive Aging threshold (for more details about Aggressive Aging, refer to 'NGX R65 What's New' document, under 'Firewall & SmartDefense', page 2).

"FW-1: Capacity problem detected"

"Connections table capacity has exceeded X%" (Console message)

"Connections table capacity has exceeded X%" (SmartView Tracker message)

These messages indicate that the Connections table capacity has increased beyond what was defined as the Aggressive Aging threshold.

For more details about Aggressive Aging, refer to 'NGX R65 What's New' document, under 'Firewall & SmartDefense', page 2.

"Main database file <(database file name)> is missing - cannot start fwm. If you wish to reset the DB please run 'cpdb new'." (Console message)

The appearance of this error message might indicate a corruption in $FWDIR/conf/objects_5_0.C. As a result, fwm will not start.

"State synchronization is in risk. Please examine your synchronization network to avoid further problems" (in /var/log/messages file)

This message may indicate that the sync network is overloaded. Overloading the sync network can cause traffic loss, unsynchronized kernel tables, and connectivity problems. For more information, refer to sk23695.

"fwlddist_adjust_buf: record too big for sync" (in /var/log/messages file and on the Console)

This message may indicate problems with the sync network. It can cause traffic loss, unsynchronized kernel tables, and connectivity problems. For more information, refer to sk35466.

"Cluster_info: (ClusterXL) member is down" (in SmartView Tracker)

This log message may indicate that the ClusterXL failed over. You can check the member's status and the failed device using the commands cphaprob stat, cphaprob list and cphaprob -a if. For more information regarding the usage of these commands, refer to CheckPoint NGX ClusterXL User Guide.pdf.

If this failover was not initiated on purpose, please contact Check Point Technical Support (as described above).

"Dead loop on virtual device sync, fix it urgently" (in dmesg file)

This message is a SecureXL notification on the outbound connection that may cause the gateway to lose sync traffic. For more information, refer to sk32765.

"FW-1: bpush: push block size error..." (Console message)

For more information, refer to sk32753 , sk59124.

"FW-1: fw_runfilter: illegal kfunc" (Console message)

These message may indicate system instability and should not be ignored.

"FW-1: fw_runfilter: stack overflow" (Console message)

This message may indicate that the number of rules in the firewall has exceeded its limit. If more rules are required, please contact Check Point Technical Support (as described above).

"FW-1: fw_runfilter: stack underflow" (Console message)

This message may indicate memory corruption problems detected by the system. System stability may be impacted.

"FW-1: fw_runfilter: wrong number of arguments..." (Console message)

This message may occur after an unsuccessful upgrade and could precede a system panic.

"FWD Error: Log(s) discarded due to unification process failure" (in SmartView Tracker)

A single "unified" log record is produced by the FireWall-1 kernel driver from a number of "basic" log records. If for some reason the building process (unification process) fails, there is a log discard followed by this error message.

This means that logs are discarded from the system and therefore will be lost.

"Database space check failed. There may not be enough disk space or it may have failed to obtain database capacity information" (in Eventia Reporter's $RTDIR/opt/CPrt-R65/log_consolidator_engine/log/lc_rt.log file).

This message means that the process is not communicating with the mysql process or there might be a problem identifying the disk. The logs will be consolidated once the problem is solved. Please check the disk capacity. Check Point also recommends checking disk sanity (for example, by using the check disk utilities).

"FW-1: panic <(x)>: " (Console message)

<(x)> represents the level of panic induced. represents the message that is associated in the code with this panic.

This error message indicates that fw_panic was called.

"FW-1: fw_kfree: memory already freed at 0x. caller is sz=" (Console message)

represents the pointer. represents the name of the function where the error happened.
This error message indicates that released memory is trying to be released again.

This is forbidden and might lead to a potential panic event.

"FW-1: fw_kfree: wrong magic number at tail end of 0x (0x) caller is sz=" (Console message)

"FW-1: fw_kfree: wrong magic number at 0x. caller is sz=" (Console message)

represents the pointer. represents the name of the function where the error happened.
These error messages might indicate an error in the way memory was handled, which might lead to a potential panic event.

"FW-1: hmem_init: unable to allocate the minimum <(x)>" (Console message)

represents the minimum memory size that is needed.

This error message indicates that the firewall's memory management module is not loaded.

"FW-1: b_create: fw_kmalloc(x) failed" (Console message)

represents the pointer.

This message may indicate an error in memory allocation for binary tables. System stability may be impacted.

"ex_init_timer: Failed to initialize timer" (Console message)

This message might indicate an error in the timer mechanism initialization. This may impact system infrastructures and cause inconsistent behavior.

"FW-1: b_create: fw_kmalloc(x) failed" (Console message)

This message might indicate a critical error in allocating a table. System stability may be impacted.

"FW-1: b_create: fw_kmalloc(x) failed" (Console message)

This message may indicate memory allocation problems. System stability may be impacted.

"fwconn_get_bits: invalid bit category: (x)" (Console message)

This error may indicate a critical error in reading the connections table. It may have a serious impact on connectivity.

"fwconn_set_bits: failed to get bit value for bit category (x)" (Console message)

This error may indicate a critical error in writing to the connections table. It may have a serious impact on connectivity.

"fwconn_chain_fill_bits: invalid bit category: (x)" (Console message)

This error might indicate a memory corruption.

"FW-1: : data connection "FWCONN6_FMT" already exists in connections table" (Console message)

This error might indicate synchronization problems between clusters.

"FW-1: : failed to get info from %s table" (Console message)

This error might indicate memory management problems.

"FW-1: : fwconn_chain_lookup failed" (Console message)

This error might indicate an inconsistency within the connection table. This may lead to connectivity problems.

"FW-1: illegal access to connections table" (Console message)

This error might indicate connectivity problems.

"FW-1: : Cannot change aggressive timeout without setting the timeout (timeout=, aggr_timeout=)" (Console message)

This error might indicate a program error that might cause Aggressive Aging not to work properly.

"Failed to build the objects schema while initializing database manager with error 0x% ('')" (Console message)

represents internal value of a pointer.

This message can indicate that there is a problem with the schema file that could prevent the fwm process from starting.

fwm not running on the system may lead to problems with connecting with the GUI client and installing the policy.

"fwhandle_get(vpn_tag.c:1275): Table kbufs - Invalid handle f5139a5c (bad pool)" (Console message)

This error message might indicate an error in the way memory was handled. It may cause RemoteAccess Connectivity issues.

"Policy install commit function was unsuccessful due to timeout" (Console message)

This error message appears during security policy installation. It indicates that policy installation on the gateway takes too much time. There is no way to know whether policy was successfully installed or not.

"Failed to get password for connection RT_Database, reason: Could not find path to database socket" (Console message)

This error means that the location of the mysql.sock file is missing. It will prevent the Eventia Reporter from connecting to the database. This problem can be fixed by doing the following:

1. Open the file $RTDIR/Database/conf/my.cnf and copy the directory that the "datadir" is referring to.

2. Run rmdstop (make sure that the database processes are down).

3. Run cd $RTDIR/Database/ .

4. Run the following commands:

bin/mysqld_safe --basedir="$RTDIR/Database"

--ledir="$RTDIR/Database/bin"

--datadir=""

--socket="$RTDIR/Database/mysql.sock" --user=root --log-error=$RTDIR/Database/err.log &

If mysql is not starting up, check the file $RTDIR/Database/err.log for errors.

Note that mysqld_safe and my_print_defaults are not part of the installation. You can download them (in WinZip format) here:

* mysqld_safe
* my_print_defaults

VI Editor Short cut key list

noreply@blogger.com (Mohana Kumar Siramdasu) — Thu, 23 Jun 2011 08:04:00 +0000

Modes
Vi has two modes insertion mode and command mode. The editor begins in command mode, where the cursor movement and text deletion and pasting occur. Insertion mode begins upon entering an insertion or change command. [ESC] returns the editor to command mode (where you can quit, for example by typing :q!). Most commands execute as soon as you type them except for "colon" commands which execute when you press the ruturn key.

Quitting
:x Exit, saving changes
:q Exit as long as there have been no changes
ZZ Exit and save changes if any have been made
:q! Exit and ignore any changes

Inserting Text
i Insert before cursor
I Insert before line
a Append after cursor
A Append after line
o Open a new line after current line
O Open a new line before current line
r Replace one character
R Replace many characters

Motion
h Move left
j Move down
k Move up
l Move right
w Move to next word
W Move to next blank delimited word
b Move to the beginning of the word
B Move to the beginning of blank delimted word
e Move to the end of the word
E Move to the end of Blank delimited word
( Move a sentence back
) Move a sentence forward
{ Move a paragraph back
} Move a paragraph forward
0 Move to the begining of the line
$ Move to the end of the line
1G Move to the first line of the file
G Move to the last line of the file
nG Move to nth line of the file
:n Move to nth line of the file
fc Move forward to c
Fc Move back to c
H Move to top of screen
M Move to middle of screen
L Move to botton of screen
% Move to associated ( ), { }, [ ]

Deleting Text
Almost all deletion commands are performed by typing d followed by a motion. For example, dw deletes a word. A few other deletes are:
x Delete character to the right of cursor
X Delete character to the left of cursor
D Delete to the end of the line
dd Delete current line
:d Delete current line

Yanking Text
Like deletion, almost all yank commands are performed by typing y followed by a motion. For example, y$ yanks to the end of the line. Two other yank commands are:
yy Yank the current line
:y Yank the current line

Changing text
The change command is a deletion command that leaves the editor in insert mode. It is performed by typing c followed by a motion. For wxample cw changes a word. A few other change commands are:
C Change to the end of the line
cc Change the whole line

Putting text
p Put after the position or after the line
P Put before the poition or before the line

Buffers
Named buffers may be specified before any deletion, change, yank or put command. The general prefix has the form "c where c is any lowercase character. for example, "adw deletes a word into buffer a. It may thereafter be put back into text with an appropriate "ap.

Markers
Named markers may be set on any line in a file. Any lower case letter may be a marker name. Markers may also be used as limits for ranges.
mc Set marker c on this line
`c Go to beginning of marker c line.
'c Go to first non-blank character of marker c line.

Search for strings
/string Search forward for string
?string Search back for string
n Search for next instance of string
N Search for previous instance of string

Replace
The search and replace function is accomplished with the :s command. It is commonly used in combination with ranges or the :g command (below).
:s/pattern/string/flags Replace pattern with string according to flags.
g Flag - Replace all occurences of pattern
c Flag - Confirm replaces.
& Repeat last :s command

Regular Expressions
. (dot) Any single character except newline
* zero or more occurances of any character
[...] Any single character specified in the set
[^...] Any single character not specified in the set
^ Anchor - beginning of the line
$ Anchor - end of line
\< Anchor - begining of word
\> Anchor - end of word
$...$ Grouping - usually used to group conditions
\n Contents of nth grouping

[...] - Set Examples [A-Z] The SET from Capital A to Capital Z
[a-z] The SET from lowercase a to lowercase z
[0-9] The SET from 0 to 9 (All numerals)
[./=+] The SET containing . (dot), / (slash), =, and +
[-A-F] The SET from Capital A to Capital F and the dash (dashes must be specified first)
[0-9 A-Z] The SET containing all capital letters and digits and a space
[A-Z][a-zA-Z] In the first position, the SET from Capital A to Capital Z
In the second character position, the SET containing all letters

Regular Expression Examples /Hello/ Matches if the line contains the value Hello
/^TEST$/ Matches if the line contains TEST by itself
/^[a-zA-Z]/ Matches if the line starts with any letter
/^[a-z].*/ Matches if the first character of the line is a-z and there is at least one more of any character following it
/2134$/ Matches if line ends with 2134
/$21|35$/ Matches is the line contains 21 or 35
Note the use of ( ) with the pipe symbol to specify the 'or' condition
/[0-9]*/ Matches if there are zero or more numbers in the line
/^[^#]/ Matches if the first character is not a # in the line
Notes:
1. Regular expressions are case sensitive
2. Regular expressions are to be used where pattern is specified

Counts
Nearly every command may be preceded by a number that specifies how many times it is to be performed. For example, 5dw will delete 5 words and 3fe will move the cursor forward to the 3rd occurence of the letter e. Even insertions may be repeated conveniently with thismethod, say to insert the same line 100 times.

Ranges
Ranges may precede most "colon" commands and cause them to be executed on a line or lines. For example :3,7d would delete lines 3-7. Ranges are commonly combined with the :s command to perform a replacement on several lines, as with :.,$s/pattern/string/g to make a replacement from the current line to the end of the file.
:n,m Range - Lines n-m
:. Range - Current line
:$ Range - Last line
:'c Range - Marker c
:% Range - All lines in file
:g/pattern/ Range - All lines that contain pattern

Files
:w file Write to file
:r file Read file in after line
:n Go to next file
:p Go to previos file
:e file Edit file
!!program Replace line with output from program

Other
~ Toggle upp and lower case
J Join lines
. Repeat last text-changing command
u Undo last change
U Undo all changes to line

SecurePlatform The netstat Command

noreply@blogger.com (Mohana Kumar Siramdasu) — Thu, 23 Jun 2011 08:00:00 +0000

netstat is a useful tool for checking your network configuration and activity. It is in fact a collection of several tools lumped together. We discuss each of its functions in the following sections.

Displaying the Routing Table

When you invoke netstat with the –r flag, it displays the kernel routing table in the way we've been doing with route. On vstout, it produces:

# netstat -nr

Kernel IP routing table
Destination Gateway Genmask Flags MSS Window irtt Iface
127.0.0.1 * 255.255.255.255 UH 0 0 0 lo
172.16.1.0 * 255.255.255.0 U 0 0 0 eth0
172.16.2.0 172.16.1.1 255.255.255.0 UG 0 0 0 eth0

The –n option makes netstat print addresses as dotted quad IP numbers rather than the symbolic host and network names. This option is especially useful when you want to avoid address lookups over the network (e.g., to a DNS or NIS server).

The second column of netstat 's output shows the gateway to which the routing entry points. If no gateway is used, an asterisk is printed instead. The third column shows the "generality" of the route, i.e., the network mask for this route. When given an IP address to find a suitable route for, the kernel steps through each of the routing table entries, taking the bitwise AND of the address and the genmask before comparing it to the target of the route.

The fourth column displays the following flags that describe the route:

G

The route uses a gateway.

U

The interface to be used is up.

H

Only a single host can be reached through the route. For example, this is the case for the loopback entry 127.0.0.1.

D

This route is dynamically created. It is set if the table entry has been generated by a routing daemon like gated or by an ICMP redirect message (see the section Section 2.5" in Chapter 2).

M

This route is set if the table entry was modified by an ICMP redirect message.
!

The route is a reject route and datagrams will be dropped.

The next three columns show the MSS, Window and irtt that will be applied to TCP connections established via this route. The MSS is the Maximum Segment Size and is the size of the largest datagram the kernel will construct for transmission via this route. The Window is the maximum amount of data the system will accept in a single burst from a remote host. The acronym irtt stands for "initial round trip time." The TCP protocol ensures that data is reliably delivered between hosts by retransmitting a datagram if it has been lost. The TCP protocol keeps a running count of how long it takes for a datagram to be delivered to the remote end, and an acknowledgement to be received so that it knows how long to wait before assuming a datagram needs to retransmitted; this process is called the round-trip time. The initial round-trip time is the value that the TCP protocol will use when a connection is first established. For most network types, the default value is okay, but for some slow networks, notably certain types of amateur packet radio networks, the time is too short and causes unnecessary retransmission. The irtt value can be set using the route command. Values of zero in these fields mean that the default is being used.

Finally, the last field displays the network interface that this route will use.
Displaying Interface Statistics

When invoked with the –i flag, netstat displays statistics for the network interfaces currently configured. If the –a option is also given, it prints all interfaces present in the kernel, not only those that have been configured currently. On vstout, the output from netstat will look like this:

# netstat -i
Kernel Interface table
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flags
lo 0 0 3185 0 0 0 3185 0 0 0 BLRU
eth0 1500 0 972633 17 20 120 628711 217 0 0 BRU

The MTU and Met fields show the current MTU and metric values for that interface. The RX and TX columns show how many packets have been received or transmitted error-free (RX-OK/TX-OK) or damaged (RX-ERR/TX-ERR); how many were dropped (RX-DRP/TX-DRP); and how many were lost because of an overrun (RX-OVR/TX-OVR).

The last column shows the flags that have been set for this interface. These characters are one-character versions of the long flag names that are printed when you display the interface configuration with ifconfig:

B

A broadcast address has been set.
L

This interface is a loopback device.
M

All packets are received (promiscuous mode).
O

ARP is turned off for this interface.
P

This is a point-to-point connection.
R

Interface is running.
U

Interface is up.

Displaying Connections

netstat supports a set of options to display active or passive sockets. The options –t, –u, –w, and –x show active TCP, UDP, RAW, or Unix socket connections. If you provide the –a flag in addition, sockets that are waiting for a connection (i.e., listening) are displayed as well. This display will give you a list of all servers that are currently running on your system.

Invoking netstat -ta on vlager produces this output:

$ netstat -ta
Active Internet Connections
Proto Recv-Q Send-Q Local Address Foreign Address (State)
tcp 0 0 *:domain *:* LISTEN
tcp 0 0 *:time *:* LISTEN
tcp 0 0 *:smtp *:* LISTEN
tcp 0 0 vlager:smtp vstout:1040 ESTABLISHED
tcp 0 0 *:telnet *:* LISTEN
tcp 0 0 localhost:1046 vbardolino:telnet ESTABLISHED
tcp 0 0 *:chargen *:* LISTEN
tcp 0 0 *:daytime *:* LISTEN
tcp 0 0 *:discard *:* LISTEN
tcp 0 0 *:echo *:* LISTEN
tcp 0 0 *:shell *:* LISTEN
tcp 0 0 *:login *:* LISTEN

This output shows most servers simply waiting for an incoming connection. However, the fourth line shows an incoming SMTP connection from vstout, and the sixth line tells you there is an outgoing telnet connection to vbardolino.[1]

Using the –a flag by itself will display all sockets from all families.

Checkpoint log repair / logging issue

noreply@blogger.com (Mohana Kumar Siramdasu) — Thu, 23 Jun 2011 07:59:00 +0000

When log files get corrupted and we get the following error in the SmartView Tracker : Failed to read record number …

To repare the log file we need to know the log file name and then from the CLI on the CLM/CMA or from the Smartcenter andn then use the following command :

[Expert@mlm]# fw repairlog

Checkpoint Firewall General checkup

noreply@blogger.com (Mohana Kumar Siramdasu) — Thu, 23 Jun 2011 07:58:00 +0000

Date, System Uptime and Clock:

Confirm the correct date is set on the system using the 'date' command.

The system uptime can be examined using the command:

uptime

Example output:

Zulu# uptime

09:46:34 up 124 days, 9:40, 1 user, load average: 0.36, 0.19, 0.14

If a low uptime is shown it normally indicates that the firewall has been administratively rebooted but it may also have been due to a self-reboot, for example due to a panic.

Low uptime - if you suspect the uptime is less than it should be check the

/var/log/messages file for the reason of the last reboot.

Disk Space

The disk space usage can be examined using the command:

df –k

Example output:

[Expert@Zulu]# df –k

Filesystem 1K-blocks Used Available Use% Mounted on

/dev/sda5 600832 187800 382512 33% /

none 600832 187800 382512 33% /dev/pts

/dev/sda1 147766 10124 130013 8% /boot

/dev/sda7 1541680 930324 533044 64% /opt

none 2045688 0 2045688 0% /dev/shm

/dev/sda6 1541680 593844 869524 41% /sysimg

/dev/sda8 27024000 5472984 20178264 22% /var

[Expert@Zulu]#

In the above example, all partitions are under 70% usage.

If a partition has a „use%' that is more than 70% but less than 90%

If the „use%' is 90% or more

See if the partition can be cleaned up to free up disk space.

/var/opt/CPsuite-RXX/fw1/log may be filled with old log files if the firewall has been logging locally.

/var/log may have old messages files

Physical RAM and Swap Space:

Examine the RAM and swap space usage (kilobytes) with:

free –k –t

Example output:

[Expert@Zulu]# free –k -t

total used free shared buffers

cached

Mem: 2058236 971332 1086904 0 95104

268984

-/+ buffers/cache: 607244 1450992

Swap: 4192944 0 4192944

Total: 6251180 971332 5279848 [Expert@Zulu]#

The „total‟ column shows the amount of RAM installed in the system (2GB in the above example)

and the amount of disk space allocated for swap space (4GB).

The amount of swap space is normally automatically set to twice the size of the physical memory, with 4 GB being the maximum.

The „used‟ column indicates how much RAM and swap space are being used.

The „free‟ column indicates how much RAM and swap space are available.

In the above example output the „used‟ column indicates <1 GB of RAM is being used and no

swap space is being used.

If for some reason the amount of free RAM becomes low, the appliance will start to preserve free RAM by swapping out the contents of the memory to the hard disk (swap space). The performance will be sub-optimal if swap space is being used due to time and resources spent writing and reading to the hard-disk.

Example Output:

[Expert@Zulu]# free –k -t

total used free shared buffers

cached

Mem: 2055120 1897424 157696 0 98732

697688

-/+ buffers/cache: 1101004 954116

Swap: 4192912 735980 3456932

Total: 6248032 2633404 3614628 [Expert@Zulu]#

Swap space usage may indicate not enough memory is installed in the appliance. The kernel is

32 bit and can use up to 4GB. It is recommended to upgrade the memory if less than 4GB of RAM

are installed.

For further information about the amount of RAM that is supported by SecurePlatform refer to:

sk22343: What is the maximum memory supported by SecurePlatform?

Memory Usage

The firewall‟s memory usage can be examined by using the command:

fw ctl pstat

The output of this command is vast and can be difficult to understand as not all the output is intuitive. The statistics that need to be checked to ensure memory is healthy are:

· hash kernel memory „hmem‟

· system kernel memory „smem‟

· kernel memory „kmem‟.

Example output:

[Expert@Zulu]# fw ctl pstat | more

Machine Capacity Summary:

Memory used: 7% (128MB out of 1638MB) - below low watermark

Concurrent Connections: 21% (43253 out of 199900) - below low watermark

Aggressive Aging is not active

Hash kernel memory (hmem) statistics:

Total memory allocated: 142606336 bytes in 34782 4KB blocks using 34 pools

Initial memory allocated: 20971520 bytes (Hash memory extended by

121634816 bytes)

Memory allocation limit: 335544320 bytes using 512 pools

Total memory bytes used: 39254196 unused: 103352140 (72.47%) peak:

133739228

Total memory blocks used: 10335 unused: 24447 (70%) peak:

32795

Allocations: 3375437074 alloc, 0 failed alloc, 3375001310 free

System kernel memory (smem) statistics:

Total memory bytes used: 188577580 peak: 227270504

Blocking memory bytes used: 1958392 peak: 2205256

Non-Blocking memory bytes used: 186619188 peak: 225065248

Allocations: 979925174 alloc, 0 failed alloc, 979924513 free, 0 failed

free

Kernel memory (kmem) statistics:

Total memory bytes used: 84876956 peak: 177110948

Allocations: 3375820431 alloc, 0 failed alloc, 3375384380 free, 0 failed

free

External Allocations: 0 for packets, 31589936 for SXL

In the above example there are no hmem, smem, kmem failed allocations.

Presence of „hmem‟ failed allocations indicates that the hash kernel memory was full. This is not a serious memory problem but indicates there is a configuration problem. The value assigned to the hash memory pool, (either manually or automatically by changing the number concurrent

connections in the capacity optimization section of a firewall) determines the size of the hash kernel memory. If a low hmem limit was configured it leads to improper usage of the OS memory. See

„Capacity Optimization‟ in the „Firewall Health Checks‟ section for further information.

Presence of „smem‟ failed allocations indicates that the OS memory was exhausted or there are large non-sleep allocations. This is symptomatic of a memory shortage. If there are failed smem allocations and the memory is less than 2 GB, upgrading to 2GB may fix the problem. Decreasing

the TCP end timeout and decreasing the number of concurrent connections can also help reduce memory consumption.

Presence of „kmem‟ failed allocations means that some applications did not get memory. This is usually an indication of a memory problem; most commonly a memory shortage. The natural limit is

2GB, since the Kernel is 32bit.)

Memory shortage sometimes indicates a memory leak. In order to troubleshoot memory shortage, stop the load you need to stop the load and let connections close. If the memory consumption returns back to normal, you are not dealing with a memory leak. Such shortage might happen when traffic volumes are too high for the device capacity. If the memory shortage happens after a change in the system or the environment, undo the change, and check whether kmem memory consumption goes down.

Open Source / free Firewall auditing software

noreply@blogger.com (Mohana Kumar Siramdasu) — Fri, 18 Mar 2011 05:57:00 +0000

Flint is the Open Source / free Firewall auditing software

Click image to enlarge

Flint examines firewalls, quickly computes the effect of all the configuration rules, and then spots problems, so you can:

save time

Clean up rusty configurations that are crudded up with rules that can't match traffic.

spot flaws

Eradicate latent security problems lurking in overly-permissive rules.

stay sane

Sanity check changes to see if new rules create problems.

people suck at thinking like firewalls

Checkpoint Upgrade to R75

noreply@blogger.com (Mohana Kumar Siramdasu) — Tue, 25 Jan 2011 08:37:00 +0000

R75 supports upgrading from lower software versions and management of lower Security Gateway versions.

Supported Management and Gateway Upgrade Paths

You can upgrade these Security Management server and Security Gateway versions to R75:

• NGX R65

• NGX R65 for SecurePlatform 2.6

• NGX R65 for IPSO 6.2 (with HFA70 only)

• NGX R65 Connectra NGX R66 Plug-in

• NGX R65 with Messaging Security

• NGX R65 VSX NGX R65 Management Plug-in

• NGX R65.3

• NGX R65 UTM-1/Power-1

• R70, R70.1, R70.20, R70.30, R70.40

• R71, R71.10, R71.20, R71.30

Important

• Upgrading from NGX R65.4 to R75 or higher is not supported.

• To upgrade Check Point Suite Products lower than NGX R65 to R75, you must

first upgrade to NGX R65 and then to R75.

Upgrading from NGX R65

When you upgrade from NGX R65, only these plug-ins may be present: Connectra,

SmartProvisioning, VSX, and Messaging Security. The presence of any other plug-in

will cause the upgrade process to fail.

If you upgrade from NGX R65 with plug-ins to R75, and later want to uninstall R75

(rollback to NGX R65), follow the instructions in sk37252

(http://supportcontent.checkpoint.com/solutions?id=sk37252)

SiteProtector transaction log cleaning up

noreply@blogger.com (Mohana Kumar Siramdasu) — Tue, 04 Jan 2011 12:17:00 +0000

At times, your database transaction log for the SiteProtector database may reach its allocated disk space. To clear your transaction log you can use the following command through the CLI on your database server.
osql -E -d RealSecureDB -Q "backup log RealSecureDB with truncate_only"
If your SQL Server is running in a named instance, you will need to run this command instead:
osql -S <server name or IP>/<instance name> -U <username> -P <password> -d RealSecureDB -Q "backup log RealSecureDB with truncate_only"

For further information on truncating SQL Server transaction logs, please review Microsoft's official MSDN article at http://msdn.microsoft.com/en-us/library/aa173551(SQL.80).aspx#

BACKUP LOG RealsecureDB WITH TRUNCATE_ONLY

Examples

Shrink a datafile to 64 Mb:

DBCC SHRINKFILE (MyDataFile01, 64);

DBCC SHRINKFILE(MyDatabase_Log, 64) WITH TRUNCATE_ONLY

DBCC SHRINKFILE

Shrink the size of the current database data / log file or empty a file by moving the data.

Syntax

      DBCC SHRINKFILE ( file , EMPTYFILE ) [WITH NO_INFOMSGS]

      DBCC SHRINKFILE ( file , target_size

              [, {NOTRUNCATE | TRUNCATEONLY }] )  [WITH NO_INFOMSGS ]

Key:

   file          -  Logical file name or file_id

   EMPTYFILE      - Migrate data to other files in the same filegroup.

                    The file can be removed with ALTER DATABASE.

   target_size   - The size for the file in megabytes.

                   default = that specified when the file was created, or

                   the last size used with  ALTER DATABASE.(int)

   NOTRUNCATE    - Free space at the end of the data file is not returned to the OS

                    (pages are still moved)

   TRUNCATEONLY  - Release free space at the end of the data file to the OS

                   (do not move pages)

      NO_INFOMSGS   - Suppress all information messages (severity 0-10)

You can shrink a transaction log file while the system is in use (DML commands are also being executed), however this will only affect the inactive portion of the transaction log file.
Discover the file_ID for each file with the SQL: SELECT file_id, name FROM sys.database_files;
After using TRUNCATE_ONLY you must perform a full backup
Examples
Shrink a datafile to 64 Mb:

DBCC SHRINKFILE (MyDataFile01, 64);

Shrink a Log file to 64 Mb:

USE MyDatabase;

GO

DBCC SHRINKFILE(MyDatabase_Log, 64)

BACKUP LOG MyDatabase WITH TRUNCATE_ONLY

DBCC SHRINKFILE(MyDatabase_Log, 64)

Afterwords, perform a full backup of the database.
To make the file as small as possible you can specify 1 for 1 Mb, or just leave out the target_size completely, be aware that doing this will slow down the system a little as the system will just have to grow the log file again as soon as another transaction is started.
Set database recovery model to SIMPLE or FULL

ALTER DATABASE MyDatabase

SET RECOVERY FULL;

GO

"Men shrink less from offending one who inspires love than one who inspires fear" - Niccolo Machiavelli
Related:
ALTER DATABASE
DBCC SHRINKDATABASE
FILE_ID
sys.database_files
Equivalent Oracle command: ALTER DATABASE Datafile '/oradata/ss64.dbf' resize 64M;

Intrusion Prevention best practices

noreply@blogger.com (Mohana Kumar Siramdasu) — Tue, 04 Jan 2011 12:15:00 +0000

Ten Best Practices for Enterprise Intrusion Prevention

by Lou Ryan

IT and network security managers face many challenges in securing their organization's critical servers from attack. Lack of dedicated security resources and the increased sophistication of attack methods are among their top headaches. Although intrusion detection systems (IDS) have been a popular solution for enterprises in the past, it is not enough to block the evolving attacks in cyber-space today. One of the main issues with IDS is that they do nothing to proactively stop intrusions before attacks occur. Also, many IDS are signature-based, so they don't detect new attacks or variations on old attacks, nor do they detect attacks in encrypted traffic such as HTTP over SSL (Secure Sockets Layer).

What's the alternative? Intrusion prevention is the next logical step in enterprise security. Intrusion prevention systems take IDS to the next level by going beyond just detecting, to actually stopping attacks before they cause damage. The difference between the two technologies is one enterprise executives are all too familiar with: Intrusion prevention blocked Code Red, Nimda, and SQL Slammer, while IDS users spent millions cleaning up after each of these.

What Is An Intrusion Prevention Solution?
There are many products and tools on the market today that use the "prevention" moniker. The right intrusion prevention solution includes enabling you to circumvent the need for analysis to be done before action can be taken to protect the system. In addition, it prevents attacks from doing damage to your operating system, applications and data. By using a system to proactively prevent attacks, there is no gap between the attack being detected, identifying it as an attack, and finally doing something to prevent it. In addition, intrusion prevention helps enterprises get better control of the costly and time-consuming process of installing software patches to plug vulnerabilities in operating systems and applications and to fend off attacks like worms and buffer overflows.

How do you choose the right type of solution for your organization? This checklist should serve as the building blocks to choosing the right enterprise intrusion prevention solution for your organization.

Table 1. Intrusion Prevention Checklist

Proactive, real-time prevention of attacks	The right solution should provide real-time prevention and analysis of attacks. It should identify the attack and prevent access to critical server resources before any unauthorized activity occurs.
Patch latency relief	Patch management is a complex process. Between the time a patch is developed and deployed, a smart hacker could compromise servers and critical data. A good intrusion prevention solution gives system administrators the protection needed during patch latency and ample time to test and deploy patches.
Protection for each critical server	Servers, where the most sensitive enterprise data resides, are on the hit list for most hackers. It is vital to have an intrusion prevention solution that is tailored for server protection. Too many solutions on the market today try to be the "ultimate" protection, by using the same mousetrap for servers and desktops. The result is thin technology that does not adequately protect sensitive systems and data.
Signatures and behavioral rules	The most effective method for identifying intrusions is a hybrid approach that combines the strengths of attack-specific signatures and behavioral rules. This hybrid approach avoids the fundamental trade-off by providing coverage to both known and unknown attacks and at the same time keep the false-positive rate to a minimum. One technology can't take the place of the other: Behavioral rules allow the servers to be protected from new and previously unknown attacks. However, the coverage of behavioral systems is limited, many attacks aren't covered, and behavioral systems generate more false positives. For full forensics capability, the signature is critical in identifying attacks, so security managers can know what sort of attack is being directed at their systems.
Layers	Strong security is founded on the concept of defense in depth: having several layers of protection. Redundant mechanisms should co-exist so that even if one hurdle is bypassed, there are always other barriers to cross.
Heterogeneous environment protection	Organizations using mixed computing environments need to be sure that the intrusion prevention they choose will be consistent across all their critical servers. It should also enable consistent, reliable cross-platform protection.
Manageable	The ideal intrusion prevention solution will allow security configurations and policies too be easily be leveraged across applications, user groups and agents to decrease the cost of installing and maintaining large security deployments.
Scalable	An enterprise-class intrusion prevention solution must scale to meet the needs of the extended enterprise while maintaining the highest levels of security. Scalability comes in the form of supporting large numbers of protected servers, supporting large amounts of event traffic, and supporting distributed security management to meet the needs of large, distributed organizations.
Low total cost of ownership	Ideally, the system you invest in should decrease costs associated with monitoring and managing total server security. Make sure that the system you are evaluating can show metrics around reducing man-hours spent on clean-up, patching, monitoring, etc.
Proven prevention technology	Beware of solutions that use the word, prevention,but are really detection-based products or desktop solutions in new packaging. It is important to investigate that the solution has been thoroughly tested, deployed, and continuously maintained, in an environment similar to your own. Read case studies, ask questions, and compare.
Strong corporate security policy	All businesses need a detailed and enforced corporate security policy.

You'll notice that there are actually eleven best practices on this list. Intrusion prevention is not a one-time implementation of point products, but a continuous evolving process. All businesses need a detailed and enforced corporate security policy. A security policy defines which "users" have access rights to which enterprise resources. Make sure the policy takes into consideration users within the enterprise as well as outside users including partners, customers, and remote employees accessing corporate resources.

About the Author
Lou Ryan is President and CEO of Entercept Security Technologies.

How do you manually configure the speed and duplex settings on a Proventia M?

noreply@blogger.com (Mohana Kumar Siramdasu) — Tue, 04 Jan 2011 12:11:00 +0000

This article explains how to manually configure the speed and duplex settings on a Proventia M.

This information applies to:
Proventia M Firmware 3.1

Fix Version:
N/A

Related Articles: See Below

Answer

To hard code the speed and duplex settings on the Proventia M perform the following steps:

Connect via SSH and login as root.
Type vi /sbin/ifup-local to create a config file.
Open the file and add a line using the following syntax:
ethtool -s [Adapter] speed [Speed in Mbps] duplex [full/half] autoneg [on/off]

Example: To set the external interface (eth1) to 10Mbps half duplex, use the following line:
ethtool -s eth1 speed 10 duplex half autoneg off
Save the file.
Change the permissions of the file by using the following command:chmod x /sbin/ifup-local
Restart the interfaces by running the following command:service network restart

Once the network interfaces have restarted, you can verify the settings have been updated by running the following command:mii-tool

This will display the current status of all links on the appliance.

How to manually purge siteprotector database

noreply@blogger.com (Mohana Kumar Siramdasu) — Tue, 04 Jan 2011 12:09:00 +0000

WARNING: This solution requires that you edit your SQL or MSDE database. Incorrectly editing your database may cause severe and irreparable damage and may require you to reinstall your database. It is recommended that you backup your database before performing any edit to it. Editing of your database should only be performed by a SQL database Administrator, or similarly qualified individual. If you are not familiar with SQL or MSDE, do not attempt this operation! IBM Internet Security Systems cannot guarantee that problems resulting from incorrectly editing your database can be solved. Proceed at your own risk. Some commands only valid in SQL 2000 but not SQL 2005 and vice versa.
NOTE: You must be logged in with local administrator privileges on the MSDE or SQL machine or the following procedures will not work. Before performing any maintenance on your database, you must first stop the Event Collector to prevent damage to the database. Restart the Event Collector only after you have completed the maintenance.
These queries can be run from Microsoft Query Analyzer using the RealSecureDB, or by using osql. To use osql, type "osql -E -d RealSecureDB" at a command prompt, then type the query and the enter key, then type "go" and enter.
Increase the size of the database
If your database is 100% full, the size of the database may have to be increased before you can purge or clear your database. Keep in mind, you can not increase your database larger than the size of the hard drive the database is on, or past 2GB if you are using MSDE. If you have your database set to grow, and you still have plenty of space on your hard drive, but your database keeps getting filled at 100%, you may also want to increase the growth rate of your database.
Increase the size of your data file
Alter database RealSecureDB modify file (name='SiteProtector site database primary data file', maxsize= 2GB)
Note that the maxsize is the size to which it will be increased. In this example, the database is being increased to 2GB. Make this number whatever you feel is best for your environment.
To force increase the size of the data file, execute the statement below:
alter database RealSecureDB modify file (name='SiteProtector site database primary data file', size= 2GB)
Increase the size of your transaction logs
Alter database RealSecureDB modify file (name='SiteProtector site database log file', maxsize= 2GB)
Again, in this example the size has been increased to 2GB.
To force increase the size of the log file, execute the statement below:
alter database RealSecureDB modify file (name='SiteProtector site database log file', size= 2GB)
Purging the database
Purges are useful because data can be removed based on a date. Data that is older than the date supplied will be purged. However, purges may take a very long time to run (possibly hours), especially with a large database, In the process, all data is compared to the date you supplied.
Information about all the different purge stored procedures is located in Knowledgebase Article #1146.
The most common procedures that you will use are iss_PurgeObs and iss_PurgeSD:
iss_PurgeObs - Removes records from the Observances tables. These records correspond to the first level event information seen in the console.
iss_PurgeSD - Removes records from the SensorData tables. These records correspond to the detailed information seen when drilling into events on the console.
All of the purge stored procedures will be called with a query like these for examples:

exec iss_PurgeSD @BeginDate='March 26, 2006', @ObsType='0,1,2,3,4,5,6,7,8,9,10'
This would purge all type of data before 3/26/2006.
exec iss_PurgeSD @BeginDate='March 26, 2006', @ObsType='0,1'
This would purge incomplete and intrusion detection data before 3/26/2006.
Note: For SiteProtector 2.0 SP6.1 and Above use the command below:
exec iss_PurgeSD @BeginDate='DATE', @ObsType='0,1,2,3,4,5,6,7,8,9', @PurgeFlag=1
Users can purge only cleared events by adding @clearedonly=1. This will only purge the data that has been cleared in the SiteProtector Console's Analysis View. An example is shown below:
exec iss_PurgeObs @BeginDate='March 26, 2006', @ObsType='0,1,2,3,4,5,6,7,8,9,10', @PurgeFlag=1, @clearedonly=1

ObsType data should be purged from the database. The descriptions are provided below:
Type Description
-------------- ------------------------------
0 Incomplete data
1 Intrusion Detection
2 Vulnerability
3 Informational Only
4 AntiVirus
5 Firewall
6 WebFilter
7 AntiSpam
8 Application Compliance
9 Network Anomaly Detection
10 File Integrity
The status of a purge can be monitored while it is running by executing the following query:
exec iss_GetPurgeStatus

Clearing/Truncating the database
Truncating the database is much faster than purging the database because it simply deletes all of the event data from the database.
WARNING: Only do this if you want to remove ALL of your event data.
NOTE: This will not remove any license or component data.
The query to truncate the event data is:
exec iss_TruncateTables
The query to truncate the transaction logs is:
backup log realsecuredb with truncate_only

Backing up the database
To do a full backup the database to the location selected in the SiteProtector automatic maintenance, or "C:\" if the location hasn't been changed, run the following two queries:
exec iss_AddBackupDevice
exec iss_BackupDatabase 'RealSecureDB'
This may take a while depending on your database size.
Shrinking the database
To shrink the size of the database to allow for more disk space, run one of the following methods:
DBCC SHRINKDATABASE ('RealSecureDB')
This will shrink both the data and log files.
DBCC SHRINKFILE (name= 'siteprotector site database primary data file')
This will shrink the data file to the initial size if possible.
DBCC SHRINKFILE (name= 'siteprotector site database log file')
This will shrink the log file to the initial size if possible.

SiteProtector transaction log 100% full

noreply@blogger.com (Mohana Kumar Siramdasu) — Tue, 04 Jan 2011 12:08:00 +0000

How to stop the transaction log of a SQL Server database from growing unexpectedly

View products that this article applies to.

INTRODUCTION

This article describes the steps that you must follow when the transaction logs...

This article describes the steps that you must follow when the transaction logs expand to an unacceptable limit. The expansion of the transaction logs can make your Microsoft SQL Server database unusable. This article also provides the options that you can use to stop the transaction logs from growing unexpectedly.

Back to the top

MORE INFORMATION

In SQL Server 2000 and in SQL Server 2005, each database contains at least one d...

In SQL Server 2000 and in SQL Server 2005, each database contains at least one data file and one transaction log file. SQL Server stores the data physically in the data file. The transaction log file stores the details of all the modifications that you perform on your SQL Server database and the details of the transactions that performed each modification. Because the transactional integrity is considered a fundamental and intrinsic characteristic of SQL Server, logging the details of the transactions cannot be turned off in SQL Server.

The transaction log file is logically divided into smaller segments that are referred to as virtual log files. In SQL Server 2000, you can configure the transaction log file to expand as needed. The transaction log expansion can be governed by the user or can be configured to use all the available disk space. Any modifications that SQL Server makes to the size of the transaction log file, such as truncating the transaction log files or growing the transaction log files, are performed in units of virtual log files.

If the transaction log file that corresponds to a SQL Server database is filled and if you have set the option for the transaction log files to grow automatically, the transaction log file grows in units of virtual log files. Sometimes, the transaction log file may become very large and you may run out of disk space. When a transaction log file grows until the log file uses all the available disk space and cannot expand any more, you can no longer perform any data modification operations on your database. Additionally, SQL Server may mark your database as suspect because of the lack of space for the transaction log expansion.

For additional information about the scenarios that may cause the transaction log file to grow unexpectedly, click the following article number to view the article in the Microsoft Knowledge Base:

317375 (http://support.microsoft.com/kb/317375/ ) Transaction log grows unexpectedly or becomes full on SQL Server

Back to the top

Reduce the size of the transaction logs

To recover from a situation where the transaction logs grow to an unacceptable limit, you must reduce the size of the transaction logs. To do this, you must truncate the inactive transactions in your transaction log and shrink the transaction log file.

Note The transaction logs are very important to maintain the transactional integrity of the database. Therefore, you must not delete the transaction log files even after you make a backup of your database and the transaction logs.

Truncate the inactive transactions in your transaction log

When the transaction logs grow to an unacceptable limit, you must immediately back up your transaction log file. While the backup of your transaction log files is created, SQL Server automatically truncates the inactive part of the transaction log. The inactive part of the transaction log file contains the completed transactions, and therefore, the transaction log file is no longer used by SQL Server during the recovery process. SQL Server reuses this truncated, inactive space in the transaction log instead of permitting the transaction log to continue to grow and to use more space.

For additional information about the issues that you must consider when you make a backup of the transaction logs and the issues that you must consider when you restore the transaction log backups, visit the following topics in SQL Server Books Online:

Transaction log backups
Transaction log backup and restore

You can also delete the inactive transactions from a transaction log file by using the Truncate method. For additional information about truncating the transaction logs, see the "Truncating the transaction log" topic in SQL Server Books Online.

Important After you manually truncate the transaction log files, you must create a full database backup before you create a transaction log backup.

For additional information about the issues that may occur when you truncate the transaction log files, click the following article number to view the article in the Microsoft Knowledge Base:

62866 (http://support.microsoft.com/kb/62866/ ) Reasons why SQL transaction log is not being truncated

Shrink the transaction log file

The backup operation or the Truncate method does not reduce the log file size. To reduce the size of the transaction log file, you must shrink the transaction log file. To shrink a transaction log file to the requested size and to remove the unused pages, you must use the DBCC SHRINKFILE operation. The DBCC SHRINKFILE Transact-SQL statement can only shrink the inactive part inside the log file.

Note The DBCC SHRINKFILE Transact-SQL statement cannot truncate the log and shrink the used space inside the log file on its own.

For more information about shrinking the transaction log files, see the following topics in SQL Server Books Online:

Shrinking the transaction log
DBCC SHRINKFILE

For additional information about how to shrink the transaction log files in SQL Server 2000, click the following article number to view the article in the Microsoft Knowledge Base:

272318 (http://support.microsoft.com/kb/272318/ ) Shrinking the transaction log in SQL Server 2000 with DBCC SHRINKFILE

For additional information about the problems that may occur when you shrink the transaction log files, click the following article numbers to view the articles in the Microsoft Knowledge Base:

814574 (http://support.microsoft.com/kb/814574/ ) PRB: Error message: "Cannot shrink log file ..." occurs when you shrink the transaction log file

324432 (http://support.microsoft.com/kb/324432/ ) PRB: DBCC SHRINKFILE and SHRINKDATABASE commands may not work because of sparsely populated text, ntext, or image columns

Back to the top

Prevent the transaction log files from growing unexpectedly

To prevent the transaction log files from growing unexpectedly, consider using one of the following methods:

Set the size of the transaction log files to a large value to avoid the automatic expansion of the transaction log files.
Configure the automatic expansion of transaction log files by using memory units instead of a percentage after you thoroughly evaluate the optimum memory size.

For additional information about the issues to consider when you configure the autogrow option, click the following article number to view the article in the Microsoft Knowledge Base:

315512 (http://support.microsoft.com/kb/315512/ ) Considerations for autogrow and autoshrink configuration

Change the recovery model. If a disaster or data corruption occurs, you must recover your database so that the data consistency and the transactional integrity of the database are maintained. Based on how critical the data in your database is, you can use one of the following recovery models to determine how your data is backed up and what your exposure to the data loss is:

Simple recovery model
Full recovery model
Bulk-logged recovery model

By using the simple recovery model, you can recover your database to the most recent backup of your database. By using the full recovery model or the bulk-logged recovery model, you can recover your database to the point when the failure occurred by restoring your database with the transaction log file backups.

By default, in SQL Server 2000 and in SQL Server 2005, the recovery model for a SQL Server database is set to the Full recovery model. With the full recovery model, regular backups of the transaction log are used to prevent the transaction log file size from growing out of proportion to the database size. However, if the regular backups of the transaction log are not performed, the transaction log file grows to fill the disk, and you may not be able to perform any data modification operations on the SQL Server database.

You can change the recovery model from full to simple if you do not want to use the transaction log files during a disaster recovery operation.

Back up the transaction log files regularly to delete the inactive transactions in your transaction log.
Design the transactions to be small.
Make sure that no uncommitted transactions continue to run for an indefinite time.
Schedule the Update Statistics option to occur daily.
To defragment the indexes to benefit the workload performance in your production environment, use the DBCC INDEXDEFRAG Transact-SQL statement instead of the DBCC DBREINDEX Transact-SQL statement. If you run the DBCC DBREINDEX statement, the transaction log may expand significantly when your SQL Server database is in Full recovery mode. Additionally, the DBCC INDEXDEGRAG statement does not hold the locks for a long time, unlike the DBCC DBREINDEX statement.

For additional information about defragmenting the indexes in SQL Server 2000, see the following Microsoft Web site:

http://technet.microsoft.com/en-us/library/cc966523.aspx (http://technet.microsoft.com/en-us/library/cc966523.aspx)

If you must run the DBCC DBREINDEX statement as a job that is a part of the database maintenance plan, you must break up the job into multiple jobs. Additionally, you must take the frequent backups for the transaction logs between the execution of the jobs.

Back to the top

REFERENCES

For additional information about troubleshooting the additional disk space requi...

For additional information about troubleshooting the additional disk space requirement during the recovery process, see the "Insufficient disk space" topic in SQL Server Books Online. For additional information about the transaction log architecture, see the following topics in SQL Server Books Online:

Transaction log architecture
Transaction log logical architecture
Transaction log physical architecture

For more information about the recovery models in SQL Server 2000, see the following topics in SQL Server Books Online:

Selecting a recovery model
Simple recovery
Full recovery
Bulk-logged recovery
Switching recovery models

Back to the top

APPLIES TO

Microsoft SQL Server 2000 Standard Edition
Microsoft SQL Server 2005 Standard Edition
Microsoft SQL Server 2005 Developer Edition
Microsoft SQL Server 2005 Enterprise Edition
Microsoft SQL Server 2005 Express Edition
Microsoft SQL Server 2005 Workgroup Edition

What's New in R75

noreply@blogger.com (Mohana Kumar Siramdasu) — Thu, 30 Dec 2010 10:55:00 +0000

What's New in R75

Check Point R75 is based on the Software Blades Architecture.
Identity Awareness in the Check Point Security Gateway

Identity based Firewall and Application Control polices including users, user-group and machines.
Logging of User Identities makes troubleshooting simpler and allows better trend analysis.
Multiple and flexible methods for obtaining user identity including seamless integration with Active Directory (no need to install agent on Domain Controller), captive web portal for clientless user authentication or thin client for strong authentication and impersonation prevention based on unique patent-pending technology for light signature of packet information.
Scalable identity sharing between multiple gateways to identify users in one or many sites and share with other gateways in the same or different sites.

Application Control Software Blade

Granular Application Control to identify, allow or block thousands of applications.
Largest application library with AppWiki - Comprehensive application control leveraging the largest application library that scans and detects more than 100,000 applications and Social Network widgets.
Auto-updates for applications database on the gateway (NO need to re-install policy).
Detect rapidly changing Social Network Widgets via online service.

Integrated DLP Software Blade
Check Point's innovative Data Loss Prevention, now available as an integrated Software Blade.

Prevents data loss of critical business information.
- Network-based solution prevents breach of corporate data.
- Compliance with data protection standards (such as PCI-DSS, HIPPA, GLBA, SOX, etc).
Cutting edge technology for DLP processes enforcement.
- Innovative MultiSpect data classification engine combines users, content and process into accurate decisions.
- New UserCheck technology empowers users to remediate incidents.
- Low maintenance, self-educating system - does not require IT/security personnel in incident handling while educating the users on proper data sharing policies.
Easy deployment for immediate data loss prevention.
- Less than one day deployment of preventative DLP solution.
- Over 250 pre-defined types to create your own policy.
- Better control and auditing capabilities with centralized security management.
New DLP features:
- ClusterXL HA support - quarantine database is synchronized between cluster members.
- Incident storage at Management server.

Mobile Access blade

Remote Access - SSL VPN technology is used for secure encrypted communication from unmanaged mobile devices, PCs and Macs to your corporate IT infrastructure.
Check Point Mobile Client - for simple and secure connectivity to corporate resources from smartphones and PCs.
Mobile Access Portal - for connecting securely to corporate resources through a portal from a web browser.
SSL Network Extender (On-demand client - SNX) - Best for secure connectivity to corporate resources using non-web-based applications via an on-demand, dissolvable client.

Endpoint Security VPN R75
Endpoint Security VPN introduces the Next Generation of SecureClient, including 64-bit support. It provides mobile users seamless and secure connectivity to corporate resources by establishing an encrypted and authenticated IPSec tunnel with Check Point Security Gateways.
Enhanced IPS signature support

Increase scalability of the IPS engine when adding many more protections.
Decrease memory footprint (currently some pattern based protections require large memory footprint).
Provide a new framework for using non-regular keywords replacing complex regular expressions.
Enhance the IPS engine to support simpler and more efficient CIFS and DCE-RPC protections.

Multi-Domain Security Management (based on proven Provider-1 technology)

R75 supports the new licensing scheme of Multi-Domain Security Management. You can easily convert an existing Security Management deployment to a Multi-Domain Security Management deployment by adding Software Blades.

Other improvements

Security Management Server supports Series 80 Appliances gateways for centrally managed branch offices.
You can set a different authentication method per blade on the same gateway. For example, a user can login to Mobile Access with certificate authentication and login to DLP with username and password authentication.
In Gateway Properties, configure the desired authentication method for IPSec VPN and Mobile Access in its respective Authentication page, and for Identity Awareness in its Authentication Settings page.
You can now use multiple portals over port 443 and port 80. For example, the SecurePlatform Web User interface and the Mobile Access portal can both be on port 443. In the SmartDashboard Gateway properties window, set the Portal URL for the different portals on the portal configuration pages.
The user search for remote access users works according to the user groups. If a user authenticates with an IPSEC VPN client and the user is in the LDAP groups of a Remote Access VPN Community, then the user will be found in the LDAP server. If a user authenticates to the Mobile Access portal, and the user is defined in the Access to Application rules as part of the Internal Database groups, the user will be found in the Internal Database.

Provider-1 solaris installation issues

noreply@blogger.com (Mohana Kumar Siramdasu) — Thu, 30 Dec 2010 04:34:00 +0000

./mds_setup: /cdrom/cp-ngx-r62/solaris2/system/shared/MDSVerUtil: cannot execute
./mds_setup: /cdrom/cp-ngx-r62/solaris2/system/shared/MDSVerUtil: cannot execute
./mds_setup: /cdrom/cp-ngx-r62/solaris2/system/shared/MDSVerUtil: cannot execute
./mds_setup: /cdrom/cp-ngx-r62/solaris2/system/shared/MDSVerUtil: cannot execute
./mds_setup: test: argument expected

Copy file to the root directory of the server then run the following command :
/bin/bash /solaris2/mds_setup

The above command will guide you through MDS/sitemanager setup.

How to find broadcast storm have on the Nortel Switched Firewall Accelerator NSF 6616 or 6614?

noreply@blogger.com (Mohana Kumar Siramdasu) — Tue, 28 Dec 2010 07:05:00 +0000

Symptom:
VRRP log messages indicating the Accelerators are changing from BACKUP TO MASTER.
       NOTICE: Accelerator 00:60:cf:ae:08:00's vrrp status changed to MASTER
Default gateways are reported as down or not in use
    Default gateway 1 (192.168.0.1) is down
Acceleration is switching from on to off to on again
     CRITICAL: Acceleration Status changed from ACCELERATING to NOT ACCELERATING

Cause:
Broadcast packets are not handled by the SPs. Instead, broadcast packets get forwarded to the MP for processing. A broadcast storm can bring the MP to 100% utilization. When the MP is running at 100% dealing with the Broadcast packets, it will not be able to send VRRP updates, default gateway health checks, accelerator health checks, and others and so on.

Problem Resolution

Fix:
The first step is to determine that you are under a Broadcast Storm.
1) Check the port Stats by running /stats/port #/if on the Accelerator. Here is the output

Interface statistics for port 3:
                    ifHCIn Counters       ifHCOut Counters
Octets:                            0                      0
UcastPkts:                      1019                  0
BroadcastPkts:              12602991             0
MulticastPkts:             78065             0
Discards:                        566                     0
Errors:                             0                0
ifInUnknownProtos:                0

In the above capture, you will see the BroadcastPkts count is much higher than the UcastPkts or the MulticastPkts. Normal traffic typically has the Ucast as the highest count.

2) You can also check the MP Stats at the time of the attack with the /stats/mp/cpu command. Here is a sample output showing the MP at 100% utilization.

>> MP-specific Statistics# cpu
------------------------------------------------------------------
CPU utilization:
cpuAUtil1Second:            100% cpuBUtil1Second:           100%
cpuAUtil4Seconds:           100% cpuBUtil4Seconds:          100%
cpuAUtil64Seconds:          97% cpuBUtil64Seconds:         98%

3) Determine the source of the Broadcast Storms. Set up a Sniffer on the suspected port and look for broadcast packets. Broadcast packets do not have IP addresses, only source and destination MAC. In a Broadcast packet, the destination MAC is FF:FF:FF:FF:FF:FF

4) When the source is determined, you will need to troubleshoot the offending device to find out why it is sending a Broadcast Storm

Check Point logging issues when the Management Server is not receiving logs from the Modules : sk40090

noreply@blogger.com (Mohana Kumar Siramdasu) — Mon, 13 Dec 2010 10:07:00 +0000

Solution

The following article is a list of steps one should go through when troubleshooting logging related issues in a distributed setup.

1. Ensure that you have not run out of disk space on the hard disk that the logs are being sent to. If this is the case, delete or move the logs to an external storage device.

2. Is there communication between the MS and the Module? Test using ping to the MS from the module and then from the Module to the MS (your rules must allow for this). If this fails, and your rules allow for this, then it is most likely a routing issue.

3. Check to see if the fw.log file is growing on the module. It should be if the logs are not going to the MS. From the console run these commands:

cd $FWDIR/log

ls -la

Verify that the fw.log file is increasing. If it is increasing then the modules are logging locally instead of forwarding the traffic to the MS. This could be a connectivity issue, or it could be the way the logging is setup. Check the FW object to ensure it is setup to send logs to the MS.

4. Can you fetch a policy? Verify that you can fetch using the hostname and IP address. If this fails then you probably have a SIC issue. To test this run the following commands:

fw fetch hostname_of_MS

fw fetch IP_Addr_of_MS (fetch by IP address also to ensure it is not a DNS issue)

5. Check the masters file. The hostname or IP address of the management station should be listed in there. To check this run the following commands:

cd $FWDIR/conf

cat masters

It should be look like this:

[Policy]

hostname_of_MS

[Log]

hostname_of_MS

[Alert]

hostname_of_MS

6. Run tcpdumps on the module, listening for port 257 on the interface facing the MS, to see if it is attempting to send logs. To check this run the following command:

tcpdump -i eth-facing-MS port 257 (use the Ctrl+C to break out of the dump)

You should see traffic leaving the FW and heading to the IP address of the MS.

You should also see traffic coming back from the MS.

7. The log file may have gotten corrupt. Run a log switch on the MS and reboot the MS to create a new log file. If logswitch does not work, move all contents of the log directory (do not move the directory itself) to a temp folder outside of the log directory. Reboot and see if the logs start again.

8. Delete the $FWDIR/log files and $FWDIR/state directory files on the module; reboot the module.

Reboot and see if the logs start again.

9. Look to see if there is a listening port for logging. Run the following command on the MS and the module:

netstat -na

You should see the *.257 LISTEN for logging connections. You should also see the IP address of the MS :257 associated with the IP address of each module, and showing an ESTABLISHED connection.

10. Check the log settings for the FW object and make sure the 'Log Server' is set to the MS that should be receiving the logs. This is usually done by default, but may have been changed by a user.

If after going through these steps you are still experiencing logging issues, please open a ticket with Nokia TAC for further troubleshooting.

Reset Fotigate Password Firmware 3.0 & 4.0

noreply@blogger.com (Mohana Kumar Siramdasu) — Mon, 13 Dec 2010 05:50:00 +0000

Reset Fotigate Password Firmware 3.0 & 4.0
Note : You will need the console cable that came with the device (RJ45 to Serial). Connect to the device using "Hyperterminal". From the time of reboot, you have 14 seconds to enter the login ID and password. Copy the login (maintainer) and password (bcpbYOURSERIALNUMBER) to Notepad/Wordpad. When prompted "copy and paste" this information.

(The serial number will be displayed during the console session)

Errors : The "hashed password" error notes that the login/password have not been entered in the time allowed. Reboot the device and "copy and paste" the login/password to the device. It may take a few attempts but it will work.

Please follow this procedure to setup console access with Fortinet's console cable :

1. Use the RJ-45 to DB-9 (or DB-9 to DB-9) serial cable and converter to connect the FortiGate Console port to the management computer serial port.
2.Start a terminal emulation program (HyperTerminal) on the management computer. Use these settings: Baud Rate (bps) 9600, Data bits 8, Parity None, Stop bits 1, and Flow Control None.
3.At the Login: prompt, please use following procedure to recover password

FG login: maintainer
Password: bcpbYOURSERIALNUMBER (Note that the letters are upper case, no spaces)

Press "Enter"

FG# conf sys admin
(admin)# edit admin
(admin)# set password xxxxxx<<this will be whatever password, (minimum of four characters) you prefer
(admin)# end
FG#

Now you should be able to log back in to the device from the gui, with the admin username and the password you've just set.

The default administrator account `admin' cannot change.
You can create administrators and assigned to the super_admin access profile. This user defined administers user name you can change.

Firewall / IPS / IDS Configuration Tips and Tricks and more..

vg_splat-lv_current 100%, Resize Checkpoint Firewall’s Disk/Partition Space (Gaia and Splat Platform)

Resize Checkpoint Firewall’s Disk/Partition Space (Gaia and Splat Platform)

1. Check volume size in the volume group vg_splat

2. Check free space on the disk

3. Check how much space assigned to the logical volume

4. Resize the logic volume from 5G to 11G

5. Resize the file system

6. Verify with df command

References:

Fortigate FortiOS 5.6 Redundant Internet Connections without SD-WAN

1. Setup gateway detection on wan1

2. Configure your interfaces

3. Configure your static routes

4. Configure Policies

5. Test and confirm

6. VPN setup

7. Using VIPs on backup links

Current Rule number missing / not showing checkpoint

How to configure NTP on Checkpoint Secureplatform / splat

where my Checkpoint Data revision files stores on Checkpoint Provider -1 Server

Checkpoint useful command reference

How to check unwanted Services running in Checkpoint Firewall / SmartCenter Server

Good Syntax Examples for TCP DUMP command in Linux / Checkpoint Secureplatform

Chechpoint Firewall / Smartcenter server - Error "Out of Memory: Killed process ()"

VI Editor Short cut key list

SecurePlatform The netstat Command

Checkpoint log repair / logging issue

Checkpoint Firewall General checkup

Open Source / free Firewall auditing software

save time

spot flaws

stay sane

people suck at thinking like firewalls

Checkpoint Upgrade to R75

SiteProtector transaction log cleaning up

DBCC SHRINKFILE

Intrusion Prevention best practices

How do you manually configure the speed and duplex settings on a Proventia M?

How to manually purge siteprotector database

SiteProtector transaction log 100% full

How to stop the transaction log of a SQL Server database from growing unexpectedly

On This Page

INTRODUCTION

This article describes the steps that you must follow when the transaction logs...

MORE INFORMATION

In SQL Server 2000 and in SQL Server 2005, each database contains at least one d...

Reduce the size of the transaction logs

Truncate the inactive transactions in your transaction log

Shrink the transaction log file

Prevent the transaction log files from growing unexpectedly

REFERENCES

For additional information about troubleshooting the additional disk space requi...

APPLIES TO

What's New in R75

What's New in R75

Provider-1 solaris installation issues

How to find broadcast storm have on the Nortel Switched Firewall Accelerator NSF 6616 or 6614?

Problem Resolution

Check Point logging issues when the Management Server is not receiving logs from the Modules : sk40090

Reset Fotigate Password Firmware 3.0 & 4.0