Configuring Polycom Video Conference System - HDX 8000

My company is using Polycom solution to provide video conference for all branches. Recently there is a issue which one way video and audio from my site. What I found trick part is the firewall settings on Polycom.

I would like to go through main configurations on our Device first:

1. On system settings page, set up name and other basic properties.
2. Network Configuration:

Do not forget to put DNS servers in it, else your time server test will be failure. Default time server is ntp.polycom.com

3. Other additional settings, such as snmp, multiple camera, multiple screen support, multipoint support. Some of them may need license to support it.

4. Since we are using Internal IP address, this device definitely is behind firewall or other security devices. During testing, we found we could not get video and audio but other site can see and hear us. After searched some documents and played a little bit, we found trick part is NAT configuration on HDX 8000.

5. Test sites from Polycom Support Page

US Test Numbers

Andover, MA

System Type: VSX 8000 #1 Network Interface: PRI ISDN Capabilities: Up to 1472K @ 60fps Test Numbers: ISDN: (978) 292-2853 LAN/IP: 140.242.250.200   System Type: VSX 8000 #2 Network Interface: PRI ISDN Capabilities: Up to 1472K @ 60fps Test Numbers: ISDN: (978) 292-2854 LAN/IP: 140.242.250.204   System Type: VS 4000 #1 Network Interface: PRI ISDN Capabilities: Up to 1472K @ 60fps Test Numbers: ISDN: (978) 292-2855 LAN/IP: 140.242.250.202          System Type: VS 4000 #2 Network Interface: PRI ISDN Capabilities: Up to 1472K @ 60fps Test Numbers: ISDN: (978) 292-2840 LAN/IP: 140.242.250.203   System Type TPX 300 Network Interface IP Only Capabilities Up to 2Mbs (Per codec) Test Numbers: Codec 1 IP: 140.242.250.223 Codec 2 IP: 140.242.250.224 Codec 3 IP: 140.242.250.225   System Type: HDX 8000 Network Interface: IP Only Capabilities: Up to 1920 @ 60fps Test Numbers: LAN/IP: 140.242.250.205

6. Enable Remote Monitoring

By default, we could not see camera snapshot from remote website. There is no option you can enable it from GUI. 

Another trick is to do it from Physical Device by remote controller at meeting room. 

after enabled Video over the web, you will see near end video or you will see both near and far end in a call. Also you can control pan left, right, close, further etc.

Enable SCP user on R75.40 Management Server

Enable SCP for SPLAT Smart-1 R75.40 Management Server

1) Login with the admin account

2) Enter Expert mode

3) Type adduser username
adduser scpuser

4) Enter the password when prompted

[Expert@CP-Management]# adduser scpuser
Enter password: 
Enter password (again): 
User 'scpuser' was added successfully


5) Type vi /etc/passwd

6) Change the end of the line with the username from /bin/cpshell to /bin/bash
It should look like this... username:x:0:0::/home/username:/bin/bash

[Expert@CP-Management]# vi /etc/passwd


root:x:0:0:root:/root:/bin/bash
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
nobody:x:99:99:Nobody:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
ntp:x:38:38::/etc/ntp:/sbin/nologin
rpm:x:37:37::/var/lib/rpm:/sbin/nologin
pcap:x:77:77::/var/arpwatch:/sbin/nologin
admin:x:0:0::/home/admin:/bin/cpshell
postfix:*:1001:1001:postfix:/no/where:/bin/false
cp_postgres:x:1002:0::/home/cp_postgres:/bin/sh
scpuser:x:0:0::/home/scpuser:/bin/bash   
~



7) Type vi /etc/group

8) Add the username to the root group
It should look like this? root:x:0:root,username

[Expert@CP-Management]# vi /etc/group

root:x:0:root,scpuser
bin:x:1:root,cp_postgres
daemon:x:2:root
sys:x:3:root
adm:x:4:root
tty:x:5:
disk:x:6:root
mem:x:8:
kmem:x:9:
wheel:x:10:root
man:x:15:
dip:x:40:
lock:x:54:
nobody:x:99:
users:x:100:
floppy:x:19:
vcsa:x:69:
ntp:x:38:
rpm:x:37:
utmp:x:22:
pcap:x:77:
postdrop:*:1007:


9) It works right away.

10) Configure winscp to log into Mgmt server
Change protocol from sftp to scp

11. Thats all.


9) Type vi /etc/scpusers 

10) Add the username on one line within this file


11) Reboot the firewall or restart sshd service

Enable Hidden 3D Report Tool on R75.40 SmartEvent Tool

What is 3D Report Tool?


It analyze your network and provide a comprehensive security analysis report – exposing security risks and suggesting remediation.

• All security threats in one single report (High risk application and web sites, intrusions attempts, sensitive data loss, bandwidth hogging and more…)
• Easy-to-read graphical reports
• This service is free of charge
• No risk to your network environment

more comments :
"The 3D Security Reporting tool was originally intended to be a sales tool of sorts for our sales teams. We also released it to partners via Partner Map. 

In R75.20, we released a separate version of the 3D Security Reporting tool. It required some minor changes to the SmartEvent server and updated SmartConsole apps.

In R75.40, we included the 3D Security Reporting tool in the regular R75.40, but it is hidden with a registry hack (as noted in the thread). We are updating the tool independently of our regular releases (at the moment) and are periodically releasing updated SmartConsole apps and SmartEvent server fixes. 

The 3D Security Report requires that MS Office be installed on the machine that the SmartConsole apps are loaded on.
"

At Partner Portal 3D Report Kit has been upgraded to R75.40.

For R75.20, Direct Download Link:
https://supportcenter.checkpoint.com/supportcenter/portal/role/supportcenterUser/page/default.psml/media-type/html?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=13231

Actually, 3D Report tool has been integrated into R75.40 SmartEvent. You just need a registry change to enable a button:

[HKEY_CURRENT_USER\Software\Checkpoint\Management Clients\6.2.5\GA\Eventia Analyzer Client] "GenerateReportsAvailable"=dword:00000001 

Actually, it will need Microsoft Office installed. Now you can check if your SmartEvent has this button or not. 

More screenshot from 3D report kit:

Templates screen:

Checkpoint SPLAT WebUI Error with browsers

Checkpoint SPLAT WebUI brings some crucial features when working on configuration or maintenance, especially for operations. In some certain environment, browser compatibility really bothers me a lot. Here is the envrionment:

SPLAT version R75.40 (but same on R75.20 and R75.30)

1. Chrome

2. IE 8

Some machines I got the following error "You must include webisapi.js in order for webisBrowserSupport.js to work. "

But it is much slower than previous version when it works.

3. Firefox 12 or 7

It shows following error when trying to browse some pages such  as upgrade:

"xslProcessor.transformDocument is not a function".

After did a research from Checkpoint website, I found this: 

R75.40 Known Limitations

"

00859599

If using Firefox 8 or higher for the SecurePlatform WebUI, this error can sometimes show: "xslProcessor.transformDocument is not a function".

"

So how about Firefox 7, actually, it is same problem.

Then I installed Firefox 4, hah, it works magically. 

Now, I always keep a copy for Firefox 4 installation file , just in case.

Update: Gaia actually doesnot have this issue from my testing. I am working on to upgrade all gateways to R75.40 Gaia version. Unfortunately, Smart-1 is having issue to Gaia. 

Sysconfig Command without first time configure wizard completed in Checkpoint appliance

Got a situation which has to remotely configure a factory reset checkpoint 2205 appliance. Unfortunately I have to do basic configuration from remote first until get internal interface configured proper ip, then I am able to run first time wizard to continue set up with new ip address. As we know after checkpoint appliance reset to factory, internal interface is 192.168.1.1.which usually not reachable for my remote access.

Good thing is I have a remote console access through Avocent Console Server 5000 series. I was thinking I can configure internal interface ip first through console. But after entered into console, I found I got into a stuck situation which is no way to issue sysconfig / cpconfig before finish first time wizard through web GUI interface.

After a google search, quickly found this post at
https://www.cpug.org/forums/check-point-utm-1-appliances/10713-setup-utm-1-via-serial-console.html

Two commands can easily resolve my problem now. Get into expert mode, then touch two magic files.

touch /opt/spwm/conf/wizard_accepted
touch /opt/spwm/conf/wizard_post_install.accepted


Then I am able to issue sysconfig to set up Internal interface ip and gateway. After all done, remove those two touched files from expert mode:


rm /opt/spwm/conf/wizard_accepted
rm /opt/spwm/conf/wizard_post_install.accepted


Then I am able to remotely run first time wizard with new ip address. CPUG saved my life again.