Network Security Memorandum: Checkpoint

Showing posts with label Checkpoint. Show all posts

Monday, April 17, 2017

Check Point Firewall Memory Issue

During regular firewall health check , I found one Check Point firewall cluster has a abnormal virtual memory usage from System Counters - System History view. The cluster is 5600 Security Appliance.

It looks the memory usage is going up significantly recently. There is no recent changes on hardware, software and configuration except normal firewall changes. I am afraid of Check Point gateway will freeze after this counter reached certain high number based on some SKs such as sk66482, sk110362,

sk35496 lists a bunch of methods how to detect memory leak. In my this specific case, the fix was simple, just installed a latest Jumbo Hotfix 205 for R77.30.

Sympotoms:
Here are some screenshots I took from Smartview Monitor

System Memory Going High for last 30 days

System Memory Going High for six months

Solution:
Suggestion I got from Check Point is to apply latest Jumbo Hotfix 205 rather than existing Jumbo Hotfix 159.

Install Latest Jumbo Hotfix from CPUSE

You may get some issues while installing your new patches/hotfixes. Here is what I met.

Patch/Hotfix Installation Failed

I have to unintall Jumbo Hotfix 159 first. Unfortunately, uninstall Jumbo Hotfix 159 also failed from CPUSE.

Uninstall Hotfix Failed

I had another post regarding "How to uninstall a CheckPoint Hotfix after a failed installation". But in this case, the cause is hotfix for sk112829 is installed after Jumbo Hotfix 159 applied. After I uninstalled Hotfix for SK112829, uninstall Jumbo Hotfix 159 was able to complete. Also Installation Jumbo Hotfix 205 was successful too.

Uninstall Successed

Waited a couple of days , I checked the used virtual memory is normal now.

Memory High Issue Fixed

Reference:

Tuesday, February 21, 2017

Check Point VPN Troubleshooting - IKEView Examples

Recently I went through Check Point VPN troubleshooting process with IKEVIEW tool. To download ikeview tool, please click here or Support Center download link.

The IKEView utility is a Check Point tool created to assist in analysis of the ike.elg (IKEv1) and ikev2.xmll (IKEv2 - supported in R71 and above) files.ike.elg and ikev2.xmll files are useful for debugging Site-to-Site VPN and Check Point Remote Access Client encryption failures.

Enabling IKE debug mode on Security Gateway results in verbose encryption-traffic information being written to the $FWDIR/log/ike.elg or $FWDIR/log/ikev2.xmll file. The Security Gateway does not require a restart or reboot after enabling IKE debug mode. The output is written in text format, and can be read with plain-text editor, but is cumbersome to interpret. The IKEView utility's GUI clearly designates IPSec Phase 1 and Phase 2 sections on a per-packet level for both IKEv1 and IKEv2

Here are some steps:

STEP 1

– Clear any existing ike.elg files, this will start a new ike.elg file and rename the old one.

[Expert@FW-CP1:0]# vpn debug trunc

[Expert@FW-CP1:0]# ls -la $FWDIR/log/ike*

STEP 2

– Turn on debug IKE debugging

[Expert@FW-CP1:0]# vpn debug ikeon

STEP 3

– Clear existing tunnels between the gateways of interest or all tunnels if you don’t care. If there are no tunnels this will force both phase 1 & 2 to be completed. If a tunnel exists then
only Phase 2 may be needed depending on the networks being connected to.

[Expert@FW-CP1:0]# vpn tunnelutil
select option 0 (Delete all IPSec+IKE SA’s for ALL peers and users)
Hit enter

STEP 4

– Trigger a VPN connection

Create a connection to trigger VPN connection that uses command ping, ftp, ssh , http,

STEP 5

– Turn off IKE debugging

[Expert@FW-CP1:0]# vpn debug ikeoff

STEP 6

– Get the ike.elg file

[Expert@FW-CP1:0]# cd $FWDIR/log/ ike.elg [check date]

either ftp this file off or SCP it out

STEP 7

– Analyze the ike.elg file in IKEView.

Example 1: Successful Phase 1 and Phase 2 with correct encryption domain sent out

Example 2: Phase 1

Example 3: Wrong Encryption Domains sent out from Check Point

Peer will send back error message which says INVALID-ID-INFORMATION

Example 4: Phase 2 failed with error message INVALID-PAYLOAD-TYPE

Other Commands:

fw tab -t vpn_enc_domain_valid -f -u

"Invalid ID" is a phase II error. During Phase II networks are exchanged along with Phase II authentication parameters. To confirm run the following command when trying to establish the tunnel:
fw tab -t vpn_enc_domain_valid -f -u

That command may not be helpful if you have many VPNs because it does not seperate the encryption domains. But basically this will list the encryption domains that the Checkpoint is sending out. If will probably be a larger subnet than what you have configured. If this is the case, search for "supernetting" in these forums. There are several ways to address the issue.

References:

Troubleshooting Checkpoint VPNs with IKEVIEW
Enabling IKE and VPN debugging

Saturday, January 21, 2017

Basic Check Point Gaia CLI Commands and Installation Videos (Tips and Tricks)

This post summarises some basic but useful CLI commands for your daily working reference especially for those who are just starting to configure your Check Point Gaia products.

For some advanced usage, please check another post "Advanced Checkpoint Gaia CLI Commands (Tips and Tricks)" in this blog.

1. show version all

FW-CP1>show version all
Product version Check Point Gaia R77.20
OS build 124
OS kernel version 2.6.18-92cp
OS edition 32-bit

2. show interface DMZ / show interfaces

FW-CP1>show interface DMZ
state on
mac-addr 00:1c:7f:37:9e:b9
type ethernet
link-state link up
mtu 1500
auto-negotiation on
speed 100M
ipv6-autoconfig Not configured
duplex full
monitor-mode Not configured
link-speed 100M/full
comments
ipv4-address 10.91.72.15/24
ipv6-address Not Configured
ipv6-local-link-address Not Configured

Statistics:
TX bytes:130970299 packets:1278980 errors:0 dropped:0 overruns:0 carrier:0
RX bytes:391610509 packets:1382114 errors:0 dropped:0 overruns:0 frame:0

FW-CP1>show interfaces
Mgmt
eth1
eth2
eth3
eth3.100
eth3.102
lo

3. set interface DMZ ipv4-address 40.40.40.1 subnet-mask 255.255.255.0

set interface DMZ state on

Note: if you are running a FW at Virtual machine, by default, only eth0 interface is on.

4. add interface lo loopback 10.10.99.1/24

add interface lo loopback 2010:10:99::1/64
delete interface lo loopback loop01

5. Show configuration and Save Config

FW-CP1>show configuration
#
# Configuration of FW-CP1
# Language version: 12.1v1
#
# Exported by admin on Fri May 15 13:51:26 2015
#
set max-path-splits 8
set tracefile maxnum 10
set tracefile size 1
set expert-password-hash $1$BBBNBcBB$BdeldpEXBxaayLxqIsKNn.
add dhcp client interface eth3
set dhcp client interface eth3 timeout 60
set dhcp client interface eth3 retry 300
set dhcp client interface eth3 reboot 10
add allowed-client host any-host
set core-dump enable
set core-dump total 1000
set core-dump per_process 2
set message caption off
set syslog filename /var/log/messages
set syslog cplogs off
set syslog mgmtauditlogs on
set syslog auditlog permanent
set clienv debug 0
set clienv echo-cmd off
set clienv output pretty
set clienv prompt "%M"
set clienv rows 63
set clienv syntax-check off
set arp table cache-size 4096
set arp table validity-timeout 60
set arp announce 2
set edition 32-bit
set snmp agent off
set snmp agent-version any
set snmp community public read-only
set snmp traps trap authorizationError disable
set snmp traps trap coldStart disable
set snmp traps trap configurationChange disable
set snmp traps trap configurationSave disable
set snmp traps trap fanFailure disable
set snmp traps trap highVoltage disable
set snmp traps trap linkUpLinkDown disable
set snmp traps trap lowDiskSpace disable
set snmp traps trap lowVoltage disable
set snmp traps trap overTemperature disable
set snmp traps trap powerSupplyFailure disable
set snmp traps trap raidVolumeState disable
set snmp traps trap vrrpv2AuthFailure disable
set snmp traps trap vrrpv2NewMaster disable
set snmp traps trap vrrpv3NewMaster disable
set snmp traps trap vrrpv3ProtoError disable
set dns primary 8.8.8.8
set web table-refresh-rate 15
set web session-timeout 10
set web ssl-port 443
set web daemon-enable on
set net-access telnet off
set inactivity-timeout 10
set timezone America / New_York
set format date dd-mmm-yyyy
set format time 24-hour
set format netmask Dotted
set password-controls min-password-length 6
set password-controls complexity 2
set password-controls palindrome-check true
set password-controls history-checking true
set password-controls history-length 10
set password-controls password-expiration never
set password-controls expiration-warning-days 7
set password-controls expiration-lockout-days never
set password-controls force-change-when no
set password-controls deny-on-nonuse enable false
set password-controls deny-on-nonuse allowed-days 365
set password-controls deny-on-fail enable false
set password-controls deny-on-fail failures-allowed 10
set password-controls deny-on-fail allow-after 1200
set ipv6-state off
add command tecli path /bin/tecli_start description "Threat Emulation Blade shell"
set ntp active on
set ntp server primary 10.9.1.5 version 1
set ntp server secondary 10.1.1.17 version 1
set aaa tacacs-servers state off
set aaa radius-servers super-user-uid 96
add user John uid 0 homedir /home/John
set user John gid 100 shell /etc/cli.sh
set user John password-hash $1$elk75EVv$JS.5C89qzA5nllgEedjGh/
set user admin shell /etc/cli.sh
set user admin password-hash $1$OadYapIm$QGqVCFYLWNvvcHWORFo0Y.
set user monitor shell /etc/cli.sh
set user monitor password-hash *
add rba user John roles adminRole
set hostname FW-CP1
set interface eth3 state on
add interface eth3 vlan 104
set interface eth3 state on
add interface eth3 vlan 106
set interface Mgmt link-speed 100M/full
set interface Mgmt state on
set interface Mgmt auto-negotiation on
set interface Mgmt ipv4-address 10.9.2.5 mask-length 24
set interface eth1 comments "Internet"
set interface eth1 link-speed 1000M/full
set interface eth1 state on
set interface eth1 auto-negotiation on
set interface eth1 mtu 1500
set interface eth1 ipv4-address 2.13.11.1 mask-length 29
set interface eth2 comments "Transfer"
set interface eth2 link-speed 100M/full
set interface eth2 state on
set interface eth2 auto-negotiation on
set interface eth2 mtu 1500
set interface eth2 ipv4-address 10.9.9.1 mask-length 24
set interface eth3 state on
set interface eth3.104 comments "Customers"
set interface eth3.104 state on
set interface eth3.104 ipv4-address 10.9.100.1 mask-length 24
set interface eth3.106 comments "Transmission 106"
set interface eth3.106 state on
set interface eth3.106 ipv4-address 10.9.102.1 mask-length 24
set interface lo state on
set interface lo ipv4-address 127.0.0.1 mask-length 8
set static-route default nexthop gateway address 20.15.11.7 priority 1 on
set static-route 10.0.0.0/8 nexthop gateway address 10.9.7.1 priority 1 on
set rip update-interval default
set rip expire-interval default
set rip auto-summary on
set management interface Mgmt
set ospf area backbone on
set lcd screensaver mode model
set lcd screensaver timeout 30

FW-CP1> save config

6. show arp dynamic all

CP-FW1> show arp dynamic all
Dynamic Arp Parameters

IP Address Mac Address
192.168.20.2 00:1B:54:13:98:41
192.168.20.250 00:17:59:F3:7E:E0
10.1.1.36 00:90:FB:2B:91:53
192.168.20.37 00:90:0B:17:E5:66
172.17.3.88 72:AC:19:9C:19:D0
172.17.3.42 00:1C:7F:32:CC:12
172.17.3.83 FE:4A:40:06:60:ED
172.17.3.6 54:4A:00:19:AE:C0
172.17.3.43 00:1C:7F:32:CC:12

CP-FW1> show arp static all
Static Arp Entries

IP Address MAC Address

CP-FW1> show arp table validity-timeout
60

CP-FW1> show arp table cache-size
1024
CP-FW1>

7. set hostname

CP-FW1> set hostname firewall-test

8. set static-route 4.4.4.0/24 nexthop gateway address 7.7.7.6 on

CP-FW1> set static-route 4.4.4.0/24 nexthop gateway address 9.9.9.2 off

// - delete a route

CP-FW1> set static-route 4.4.4.0/24 off

CP-FW1> set static-route 172.116.14.0/24 nexthop blackhole

CP-FW1> set static-route 40.40.40.0/24 rank 2

FW-CP1>show route static
Codes: C - Connected, S - Static, R - RIP, B - BGP,
O - OSPF IntraArea (IA - InterArea, E - External, N - NSSA)
A - Aggregate, K - Kernel Remnant, H - Hidden, P - Suppressed,
U - Unreachable, i - Inactive

S 0.0.0.0/0 via 20.13.11.7, eth1, cost 0, age 142743
S 10.9.8.0/24 via 10.9.9.7, eth2, cost 0, age 77668
Infra
S 10.9.13.0/24 via 10.9.9.7, eth2, cost 0, age 77668
Customers
S 10.0.0.0/8 via 10.9.7.1, Mgmt, cost 0, age 105717
S 1.24.7.9/32 via 10.9.10.21, eth3.102, cost 0, age 80698
Test1

9. set date 2012-08-10

10. reboot & halt

11. fw unloadlocalUnload local firewall policy from the appliance.

12. cpstop / cpstart

13. fw ver
This is Check Point VPN-1(TM) & FireWall-1(R) R75.40 - Build 275

14. cpstat

FW-CP1> cpstat os
Product Name: SVN Foundation
SVN Foundation Version String: R77.20
SVN Foundation Build Number: 990170256
SVN Foundation Status: OK
OS Name: Gaia
OS Major Version: 2
OS Minor Version: 6
OS Build Number: -
OS SP Major: -
OS SP Minor: -
OS Version Level:
Appliance SN: 338B04265
Appliance Name: Check Point 4200
Appliance Manufacture: CheckPoint

15. Increase session time-out time

It is especially useful before doing upgrade.

set web session-timeout 1440
set inactivity-timeout 720

16. Information about processes, memory, paging, block IO, traps, and cpu activity.

FW-CP1> vmstat 1 |awk '{now=strftime("%Y-%m-%d %T "); print now $0}'
2014-10-29 09:26:47 procs -----------memory---------- ---swap-- -----io---- --system-- -----cpu------
2014-10-29 09:26:47 r b swpd free buff cache si so bi bo in cs us sy id wa st
2014-10-29 09:26:47 1 0 448004 10748 1928 126520 10 13 53 581 118 155 8 11 81 1 0
2014-10-29 09:26:49 1 0 448004 10748 1936 126520 0 0 0 84 1123 2197 5 10 84 0 0
2014-10-29 09:26:51 1 0 448004 10780 1936 126520 0 0 0 0 1123 2145 3 6 92 0 0
2014-10-29 09:26:53 1 0 448004 10500 1944 126512 0 0 0 82 1123 2204 6 13 82 0 0
2014-10-29 09:26:55 1 0 448004 10500 1944 126520 0 0 0 0 1125 2139 6 11 84 0 0

17. CPView – Check Point and System Online statistics Info

It is a nice tool for gathering system information and statistics introduced from R77.

[Expert@CP-1:0]# cpview
Initializing...Server Connection Menu for your Master Terminal Server
|------------------------------------------------------------------------------|
| CPVIEW.Overview 16Aug2015 10:45:42 |
|------------------------------------------------------------------------------|
| Overview SysInfo Traffic I/S Software-blades |
|------------------------------------------------------------------------------|
| CPU: |
| |
| Num of CPUs: 1 |
| |
| CPU Used |
| 0 0% |
| ---------------------------------------------------------------------------- |
| Memory: |
| |
| Total MB Used MB Free MB |
| Physical 934 684 250 |
| FW Kernel 696 62 634 |
| Swap 2,047 0 2,047 |
| ---------------------------------------------------------------------------- |
| Traffic counters: |
| |
| Throughput 930bps |
| Packet rate 1pps |
| Connection rate 0cps |
| Concurrent conns 42 |
| ---------------------------------------------------------------------------- |
| Disk space (top 3 used partitions): |
| |
| Partition Total MB Used MB Free MB |
| /boot 144 105 31 |
| / 8,063 4,928 2,725 |
| /var/log 60,475 6,665 50,738 |
| ---------------------------------------------------------------------------- |
| Events: |
| |
| # of monitored daemons crashed since last cpstart 0 |
| |
| |
|------------------------------------------------------------------------------|

18. TOP

[Expert@CP-M-DMZ:0]# top
top - 10:17:21 up 10 days, 24 min, 1 user, load average: 0.35, 0.26, 0.26
Tasks: 83 total, 2 running, 81 sleeping, 0 stopped, 0 zombie
Cpu(s): 6.6%us, 9.9%sy, 0.0%ni, 83.2%id, 0.0%wa, 0.0%hi, 0.3%si, 0.0%st
PID USER PR NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND
5468 admin 21 0 67728 6832 3996 S 1.7 0.7 198:41.66 DAService
3966 admin 15 0 32900 13m 8804 S 0.3 1.5 52:12.94 confd
4005 admin 15 0 30600 11m 8764 S 0.3 1.2 58:01.37 snmpd
1 admin 15 0 2040 648 560 S 0.0 0.1 0:01.09 init
2 admin RT -5 0 0 0 S 0.0 0.0 0:00.00 migration/0
3 admin 15 0 0 0 0 S 0.0 0.0 0:00.18 ksoftirqd/0
4 admin RT -5 0 0 0 S 0.0 0.0 0:00.00 watchdog/0
5 admin 10 -5 0 0 0 S 0.0 0.0 0:00.27 events/0
6 admin 10 -5 0 0 0 S 0.0 0.0 0:00.04 khelper
7 admin 10 -5 0 0 0 S 0.0 0.0 0:00.00 kthread
8 admin RT -5 0 0 0 S 0.0 0.0 0:00.00 kmem_kthread
11 admin 10 -5 0 0 0 S 0.0 0.0 0:00.09 kblockd/0
12 admin 20 -5 0 0 0 S 0.0 0.0 0:00.00 kacpid
113 admin 20 -5 0 0 0 S 0.0 0.0 0:00.00 cqueue/0
116 admin 10 -5 0 0 0 S 0.0 0.0 0:00.00 khubd
118 admin 10 -5 0 0 0 S 0.0 0.0 0:00.00 kseriod
178 admin 15 0 0 0 0 S 0.0 0.0 0:00.96 pdflush
179 admin 15 0 0 0 0 S 0.0 0.0 0:00.01 pdflush
180 admin 17 -5 0 0 0 S 0.0 0.0 0:00.55 kswapd0
181 admin 20 -5 0 0 0 S 0.0 0.0 0:00.00 aio/0
344 admin 11 -5 0 0 0 S 0.0 0.0 0:00.00 kpsmoused
369 admin 14 -5 0 0 0 S 0.0 0.0 0:00.00 ata/0

By default, it will sort by PID. You can type O to get into Sort Change Window. Then you can change which field you want to sort it. K for %CPU are n for %mem are most useful sorting field.

Current Sort Field: K for window 1:Def
Select sort field via field letter, type any other key to return
a: PID = Process Id
b: PPID = Parent Process Pid
c: RUSER = Real user name
d: UID = User Id
e: USER = User Name
f: GROUP = Group Name
g: TTY = Controlling Tty
h: PR = Priority
i: NI = Nice value
j: P = Last used cpu (SMP)
* K: %CPU = CPU usage
l: TIME = CPU Time
m: TIME+ = CPU Time, hundredths
n: %MEM = Memory usage (RES)
o: VIRT = Virtual Image (kb)
p: SWAP = Swapped size (kb)
q: RES = Resident size (kb)
r: CODE = Code size (kb)
s: DATA = Data+Stack size (kb)
t: SHR = Shared Mem size (kb)
u: nFLT = Page Fault count
v: nDRT = Dirty Pages count
w: S = Process Status
x: COMMAND = Command name/line
y: WCHAN = Sleeping in Function
z: Flags = Task Flags <sched.h>
Note1:
If a selected sort field can't be
shown due to screen width or your
field order, the '<' and '>' keys
will be unavailable until a field
within viewable range is chosen.
Note2:
Field sorting uses internal values,
not those in column display. Thus,
the TTY & WCHAN fields will violate
strict ASCII collating sequence.
(shame on you if WCHAN is chosen)

At TOP window, type lower case o will get you Field Define Window. h will get you help window.

19. Check Point Visio Stencils for Downloading
Check Point released their new products stencils public for downloading. You will not need Check Point account to download. It does not include some old models. Following appliance includes in this 3M file:

2200
3200
4000
5000
12000
13000
15000
21000
23000
41000-61000
Accessories
SandBlast
Smart-1
SMB-ROBO

Check Point SK Link sk101866.

Here is Download Link from Check Point Website: http://dl3.checkpoint.com/paid/90/902caf44a13d71e91a35315e4a28caa8/CheckPoint_Stencils_for_Visio.zip?HashKey=1480871979_bb9dd6cf9a98c6bf41f3cd1fd147c855&xtn=.zip

20. Change WebUI port to 4434
from Command line:

webui disable
webui enable 4434

Unfortunately after a cpstop/cpstart or reboot, the 4434 port will not survive. It rolled back to 443 again.

Solution:

Firewall ->Properties -> SecurePlatform -> change main url to :http://x.x.x.x:4434

goto command line do webui changes

push policy.

R77.30 & R80 Gaia InstallationVideos:

Check Point R77.30 Lab Series 1 - Installing Management Server (51sec)

Check Point R77.30 Lab Series 2 - Installing Gaia Cluster Gateways (51sec)

Check Point R77.30 Lab Series 3 - Clustering : First Time Wizard and Management

Check Point R80 Management Installation in VmWare Part 1- Installation and First Time Wizard

Check Point R80 Management Installation in Vmware Part 2 - SmartConsole

Check Point R80 Management Installation in Vmware Part 3- Dashboard

Note: I have moved some advanced Checkpoint CLI commands into another post, please check "Advanced Checkpoint Gaia CLI Commands (Tips and Tricks)" in this blog.

Reference:

Sunday, December 4, 2016

Check Point Appliance Visio Stencils for Downloading

Check Point released their new products stencils public for downloading. You will not need Check Point account to download. It does not include some old models. Following appliance includes in this 3M file:

2200
3200
4000
5000
12000
13000
15000
21000
23000
41000-61000
Accessories
SandBlast
Smart-1
SMB-ROBO

Check Point SK Link sk101866.
Here is Download Link from Check Point Website: http://dl3.checkpoint.com/paid/90/902caf44a13d71e91a35315e4a28caa8/CheckPoint_Stencils_for_Visio.zip?HashKey=1480871979_bb9dd6cf9a98c6bf41f3cd1fd147c855&xtn=.zip

Monday, October 24, 2016

Check Point Firewall USB Installation Step by Step (R77.20 and R77.30)

Customer is asking a new fresh installation on their UTM 272 devices and apparently usb stick or usb cd-rom is best solution. Checkpoint sk65205 explains very detail for all steps. I did follow the Check Point instruction but still got a problem while using USB stick. Here are all my steps I worked on.

1. Preparing USB Stick

I am using a Kingston Traveller G3 8G USB stick which shows supported from Check Point sk92423 (Which USB flash keys work with ISOmorphic Tool).

2. Use ISOMorphic to make a R77.20 bootable USB Stick.

3. Start your Device with USB Stick Plugged in

Insert USB Stick into one of two Check Point Appliance UTM 272 USB ports. Powered on device:

4. BIOS Configuration

Press TAB or DEL to enter into BIOS setup the booking devices. USB-HDD and USB-CDROM has been picked for boot devices.

5. USB Stick Does Not Work

Unfortunately the system did not start with the USB device but still with internal hard disk drive. I did find following error messages from the booting screen:

usb 1-2: device not accepting address 2, error 071

6. USB CDROM Worked

No Matter how I did the configurations on appliance, usb still did not work. I gave up and tried another UTM272, but same result. Finally I got a USB CD-ROM, burned same image into a DVD, it was able to get me into SYSLINUX page.

7. With those options, the only works is Smart-1 option.

8. Installing

After you entered Smart-1 option, the installation is completely automatic.

9. Complete Installation

Wait probably 15-30 minutes, the whole installation will be done and your console window will show your appliance can be safely rebooted with new image. Also Appliance LCD Screen will show ***Installed*** R77.20 124. Powers Cycle your device, you will get your a new fresh installed R77.20. By the way, first time installation wizard will be used to configure your device with LAN port ip set to 192.168.1.1. User name is admin and password is admin.

Notes:

I tested the stick with my laptop, and it is able to booted from USB stick and I did get SYSLINUX prompt on my laptop. It bothered me a couple of day why it is not working on UTM 272s.

Since USB CD-ROM is working, I decided to wipe USB Stick out and tried ISOMorphic again on another laptop. This time, USB Stick works. I am guessing when ISOMorphic is making a bootable USB Stick, your computer is going to affect the final image on the stick.

More notes on Oct 2016;
Tried it again on Check Point 2012 4200 appliance to install R77.30. I were using same usb memory stick as my previous post. Added some more screenshots and words here:

once you plugged in your usb key, if it has been recognized, you will get a chance to run setup or boot it from network.

You may get a error message to say usb 3-1: device descriptor read/all, error -71

If all goes well, you should get SYSLINUX 4.06 booting screen and choose serial as output:

starting installation process