Checkpoint

fw ctl pstat Command Requires Admin Rights

Known Affected platforms: All

Result: Without this command collected no memory utilization will be present

ARP table contains only master VSYS 0 entries

Known Affected Software Versions: R80.30 and R80.40

Result: Command show arp dynamic all on VSx always (by mistake) shows ARP only for the master VSYS 0 regardless of active VSYS. It is a confirmed bug on the Checkpoint firewalls.

Discovery of Security Policies

• Wildcard & Dynamic objects and negated services are not supported

• Settings > Advanced > Vendor API: In case that base URL points to a multi-domain server address, domains have to be specified

Required Permissions For Successful Discovery Over CLI

To successfully discover a CheckPoint Gateway, correct role have to be assigned to a user. IPF requires role features set as read-only, except of “Virtual-System” where read-write is needed (only if VSX firewalls are in your network, otherwise read-only is enough).

How To Setup a Role From Web GUI

1. Open CheckPoint Gaia web interface

2. Navigate to User Management -> Roles in the left menu

3. Click Add, fill in the name. In the Features tab select all items and mark them as Read-Only. No permissions from Extended Commands tab are needed.

4. If you have VSX firewall in your network, you have to set Virtual-System feature to Read-Write (we call set virtual-system \<ID> to switch to proper virtual system). This allows IPF just to change context and can’t be used for anything else.

5. Assign the role to the user used for IPF discovery