Install / Upgrade Checkpoint Full HA (Gateway and Management) on Check Point Appliances

Checkpoint Support KB SK60443 shows a document regarding How to install Full HA cluster on Check Point Appliances.

Here I will use my LAB to present all steps with more screenshots. First two steps are mostly coming from SK60443 document.

Topologies

1. Initial Connection 

• Connect a crossover cable from a PC workstation t o the Internal NIC of the Appliance.
• Set the IP of the workstation at: 192.168.1.x / 24. use any IP except ".1", which is the default for the Checkpoint appliance.
• Open a web browser and connect to https://192.168.1.1:4434
• If you have a pop up blocker, you’ll need to disable it or add an exception for 192.168.1.1.
• If presented with a dialog similar to the following, choose the option to "Continue to this website...":
• Log in with the default account information: user admin, password admin .
• Follow the prompts to change the default password.

2. First Time Configuration Wizard on Primary Firewall

• Follow the prompts to work through the First Time Configuration Wizard. Review the Welcome screen, and click Next
• Set the Date and Time manually or configure an NTP server, then click Apply, then click Next
• Remember to set the Time and Time Zone accurately.
• Configure your network connections: Click on an interface name to set the IP address, netmask, and Link Speed/Duplex properties for that interface: When set, click Apply , which returns you to the previous screen. Repeat for each NIC, then click Next
• Configure your routing table.Click New , enter the route, and click Apply , which returns you to the previous screen. When all routes are entered, click Next
• Enter the firewall’s host name, domain name, and DNS servers, then click Next
• Configure the management type. For both Primary and Secondary firewalls, choose "Locally Managed"

• Configure clustering. Mark the checkbox to indicate the appliance is part of a cluster, and then select theappropriate optionbutton indicating if it is the primary or secondary member:

• Configure allowed SSH and GUI client IP addresses, then click Next
• If needed, click Start Download to download the SmartConsole application to the workstation, then click Next
• The wizard presents a summary of the installation and offers the options to go back to make any changes, quit, or finish the configuration wizard. If there are any changes necessary, use Back/Next to navigate to the page where you need to make the change, and return to the summary screen. Once all parameters are correct, click Finish

3. First Time Configuration Wizard Secondary Firewall

• Only difference from Primary Firewall is to choose secondary cluster member when configuring UTM-1 Cluster:

4. Configuring the Cluster in SmartDashboard

• Log in to SmartDashboard, approve the First Time Fingerprint Verification. The UTM-1 Cluster Wizardwill run, presenting an introductory page. Click Next

• Provide a name for the cluster object, then click Next

• Provide the information requested about the secondary cluster member: this includes the Activation Key recorded when installing the secondary cluster member.Click Next

.

•  Configure Sync Interface

 

• Configure Internal Interface

•  Configure External Interface

•  Finish the Cluster configuration in the Smartdashboard. Check property of Cluster object.

5. Completing the Procedure

•  Click Management High Availability from Policy Menu

• 'No Peers' Error came up. 

•  No Server shows in the status window because of no policy installed.

•  Push Firewall Policy to the cluster with a minimum two rules policy. 

 Right away to check Management High Availability again, you will see synchronization is in progress.

• Wait Probably 5 minutes, Click Management High Availability you will see both server are showing in the status window which CP-1 is Primary Management Server and Active Secure Gateway. CP-2 is Secondary Management Server and Standby Secure Gateway.

6. Verifying

• Log into CP-2 Secondary Management Server. In my test LAB, CP-1 is using 192.168.2.41. CP-2 is with 192.168.2.42.

• After password verified, Secondary Server Login window pops up to ask you if Change to active or Login as Read Only.

• Click Change to Active button then you will be able to log into SmartConsole. Check status again you will find CP-2 is secondary Management Server but now it is active. Management failover is successful.

------------------------------------------------------------------------------------------------------------

Regarding how to upgrade Gaia Full HA Checkpoint Implementation, the steps are listed at CP_R77_Gaia_Installation_and_Upgrade_Guide.pdf. It is at Page 75 Upgrading Standalone Full High Availability.

I am summarizing them in the following:

1. Backup

• Snapshot
• Backup
• Export DB
• Show configuration

2. Mostly Upgrading with Minimal Downtime method will be used.

• Make sure the primary cluster member is active and the secondary is standby: check the status of the members.
• Start failover to the second cluster member.
  The secondary cluster member processes all the traffic.
• Log in with SmartDashboard to the management server of the secondary cluster member.Click Change to Active.
• Configure the secondary cluster member to be the active management server.
  Note - We recommend to export the database using the Upgrade tools (on page 65).
• Upgrade the primary cluster member to the appropriate version.
• Log in with SmartDashboard to the management server of the primary cluster member.
  Make sure version of the SmartDashboard is the same as the server.
• Upgrade the version of the object to the new version.
• Install the policy on the cluster object.
  The primary cluster member processes all the traffic.
  Note - Make sure that the For Gateway Clusters install on all the members option is cleared. Selecting this option causes the installation to fail.
• Upgrade the secondary cluster member to the appropriate version.
• Synchronize for management High Availability.

Export Checkpoint Firewall Policy to HTML/XML/Excel and Checkpoint Management Portal using cpdb2web tool

I was looking for a tool to export Checkpoint Management Server database to a readable format in Excel or Html format. Checkpoint already has a great tool and KB to present a solution for this purpose:

"sk64501:Exporting Check Point configuration from Security Management Server into readable format using Web Visualization Tool"

1. Installation the Web Visualization Tool cpdb2html

Download it from the link.
Extract the file cpdb2web_B983000003_1.tgz into a folder. You will get these files in the folder:

2. Command line

C:\Tools\cpdb2web_B983000003_1>cpdb2html.bat ?Check Point Web Visualization Tool
Usage: cpdb2html cpdb2html_path output_directory security_management (admin_name
 or certificate_file) password [-o output_file_name] [-m gateway] [-gr] [-go]
Where:
cpdb2html_path      - Web Visualization Tool's root directory.
output_directory    - Path to place the result html file.
security_management - Name or IP address of the Security Management.
                      (for Multi-Domain Security Management the IP associated
                      with a Domain).
admin_name /
certificate_file    - User name of a Security Management administrator, or full
                      path of a certificate file.
password            - Administrator's password, or certificate's password.
-o output_file_name - HTML output file name to use
                      (default file name is '1.html').
-m gateway_name     - A specific gateway for which to generate the policy.
-gr                 - For Check Point Multi-Domain Security Management only.
                      When the -gr option is set the output will include
                      customer rules only (no global rules).
-go                 - For Check Point Multi-Domain Security Management only.
                      When the -go option is set the output will include
                      customer objects only (no global objects).

C:\Tools\cpdb2web_B983000003_1>cpdb2html.bat c:\tools\cpdb2web_B983000003_1 c:\tools\output 192.168.2.37 admin Password1234
CUR_PATH = c:\tools\cpdb2web_B983000003_1
TARGET_DIR = c:\tools\outputHOST = 192.168.2.37
USERNAME = adminPASSWORD = Password1234
TEMP_DIR = "c:\tools\output\temp"
XSLDIR = c:\tools\cpdb2web_B983000003_1\xsl
XSLFILE = stripped_html.xsl
BASE_XML_FILE = stripped_html.xml
OUTPUT_FILE = 1.html
POLICY_NAME = standard
Connected to Security Management version 9.9.0.
Querying tables...
Processing table Communities ...FinishedProcessing table FireWall Policies ...FinishedProcessing table Network Objects ...FinishedProcessing table Services ...FinishedProcessing table Users and Administrators ...Finished
0 1 file(s) copied. 1 file(s) copied.C:\Tools\cpdb2web_B983000003_1>

Notes: you could customize your output file name with date and time in it. Here is a script example with date in the output name used in my test environment:

cd D:\Download\cpdb2webcpdb2html.bat d:\Download\cpdb2web d:\Download\cpdb2web\output 10.9.2.7 admin Password1234 -o %date:~0,2%_%date:~3,2%_%date:~6,4%_%date:~11,2%_%date:~14,2%policy.html

I got output file name "10_09_2014__policy.html" when ran on Sep 10 2014. If you run this .bat file in a windows schedule task weekly as shown below, you will get an automatically backup of your policies.

3. Output in HTML and Excel

Html page will include Security Policy, Address Translation Policy, Network Objects, Users and Services.

The policy can be imported / copied into Excel for further editing.

Notes:

1. Actually the cpdb2html.bat is only able to use to export one active or last opened policy to html. For multiple policies you either use -m option to specify the gateway one by one in your script just like following line: 

cpdb2html.bat d:\Download\cpdb2web d:\Download\cpdb2web\output 10.4.2.3 admin password1234 -o %date:~0,2%_%date:~3,2%_%date:~6,4%_%date:~11,2%_%date:~14,2%GDSCI-Internet.html -m CP-Internet

2 You could use following script (cpdb2web.exe) to export all policies to xml file, then convert them one by one to html pages:

mkdir output\tempset output_dir=D:\Download\cpdb2web\output\%date:~0,2%_%date:~3,2%_%date:~6,4%_%date:~11,2%_%date:~14,2%mkdir %output_dir%echo %output_dir%
cpdb2web -s 10.4.2.3 -u admin -p passwoed -o d:\Download\cpdb2web\output\temp
copy D:\Download\cpdb2web\xsl\strip*.* D:\Download\cpdb2web\output\temp\strip*.*
cd D:\Download\cpdb2web\output\tempcopy ECOMM_Security_Policy.xml Security_Policy.xmlcopy ECOMM_Nat_Policy.xml Nat_Policy.xmlcd D:\Download\cpdb2webXalan.exe -o %output_dir%\Brazil-DMZ.html "D:\Download\cpdb2web\output\temp\stripped_html.xml" "D:\Download\cpdb2web\output\temp\stripped_html.xsl"
cd D:\Download\cpdb2web\output\tempcopy DMZ_Security_Policy.xml Security_Policy.xmlcopy DMZ_Nat_Policy.xml Nat_Policy.xmlcd D:\Download\cpdb2webXalan.exe -o %output_dir%\GDSCI-RAS.html "D:\Download\cpdb2web\output\temp\stripped_html.xml" "D:\Download\cpdb2web\output\temp\stripped_html.xsl"

3. For browsing purpose, the easiest way is to copy all these XML files inside this sub-directory. Firefox is best one for browsing xml file. Chrome and IE will not process xml file the way we want:

<Visualization_Tool_installation_directory>/xsl/xml/.

Then, open the <Visualization_Tool_installation_directory>/xsl/index.xml file with your web browser .

In my case, command line is :

copy D:\Download\cpdb2web\output\temp\*.* D:\Download\cpdb2web\xsl\xml\*.*

Then open it in the browser:

------------------------------------------------------------------------------------------------------------

Checkpoint Management Portal Screenshots:

It can show gateways status, logs, policies and objects.

Creating Checkpoint VSX and Virtual System - Part 1

VPN-1/FireWall-1 Virtual System Extension (VSX) is a security and VPN solution, designed to meet the demands of large-scale environments. Centrally managed and incorporating key network resources internally, VSX allows businesses to offer comprehensive firewall and VPN functions to their customers, while reducing production costs and improving efficiency. Through a “virtualization” of network infrastructure, VSX allows administrators to use it to replace a collection of standard hardware devices. The VSX Gateway is comprised of a virtual topology that includes virtual devices that replace physical ones, such as routers, traditional firewalls, and even some network cables. 

Checkpoint Configuring VSX document shows how to create a new VSX system and how to create new virtual system, router and switch as well. This is the post to record the procedure how the lab has been done in my virtual environment.

I am using VMware ESXi version 5.5.0 build 1623387 as the host to do lab for Checkpoint related products.In previous lab, a standalone security gateway R77.20 with management has been installed. This time I will add a new VSX gateway and a couple of virtual system, router and switch in.

Step1: create a new VSX gateway with VSX Gateway Wizard:

For how to install Checkpoint Gateway and management server, you should be able to find lots of videos in Youtube website, such as the following two:

•  Checkpoint GAIA R77 Installation & Configuration part I

• Checkpoint GAIA R77 Installation & Configuration part II

After you have installed Checkpoint Gateway and management server on your VM system, you will need to log into Checkpoint Smart Dashboard to start VSX gateway wizard.

 2. During wizard, you will have an option to add virtual system, virtual router or virtual switch in:

 

 3. VSX Gateway Properties:

 4. Now we can create Virtual System, Virtual Router or Virtual Switch

Checkpoint SmartConsole R77.20 Installation Issue - SmartDashboard 'Loading local configuration' up to 15% and then disappears

Installed Checkpoint R77.20 in virtual machine to do testing. The installation of gateway and mgmt server is not having problem, but had an issue while installing SmartConsole R77.20 on windows 7 machine.

Symptons:

1. First error I met is at during installation. 

Unable to register dlls in:

C:\Program Files\CheckPoint\SmartConsole\R77.20\PROGRAM\pe_components_reg.conf

 After clicked OK button, installation was able to complete.

2. Second error message is popped up when tried to run SmarConsole applications, such as SmartDashboard, SmartTrack, SmartMonitor etc. 

This error is common happened. Google Internet for “The program can’t start because MSVCR100.dll is missing from your computer.”. You will get tons of solutions. Basically just need to install one of following Microsoft Visual C++ Redistributable package :
32 bit: http://www.microsoft.com/download/en/details.aspx?id=5555
64 bit: http://www.microsoft.com/download/en/details.aspx?id=14632

3. Finally I got the SmarDashboard Log in Window:

 Typed username , password and mgmt server ip address, clicked login. SmartDashboard window disappeared at loading application data at 15%.

Solutions:

I was keeping trying to system update, install patch, re-install R77.20 with different ways. Finally I got the following solutions on my windows 7 machine:

1. Install R77.10 SmartConsole first

2. Install R77.20 SmartConsole

---------------------------------------------------------------------------------------------------------------------------------------

Notes: 

Another troubleshooting tool from Checkpoint is traceutil.exe:

To enable logs in UI do the following:
1) Open the TraceUtil.exe found under the Smart Console install directory (C:\Program Files (x86)\CheckPoint\SmartConsole\R77.10\PROGRAM)

2) Check enabled in Endpoint Security Console, and output to file, you should select a location of the file with '…' button

3) Under the topics click add , type ALL in topic and 5 in level, click OK

4) Click Apply on the dialog, next time you will run the Endpoint Management, logs would be created.

The logs may be ok to send to Checkpoint support, but not useful for me to figure out the problem I were facing.

Pushing Policy Failed because Checkpoint Firewall "Load on module failed - no memory"

One day when pushing firewall policy from Checkpoint management server to UTM 272 cluster gateways, it failed and I got error message "Load on module failed - no memory" on one of cluster members.

"Network Security Policy 'Montreal_DMZ' was prepared on Tue Sep 16 10:00:58 2014.

The following errors and warnings exist:

Installation failed. Reason: Load on Module failed - no memory. ( message from member fw_Montreal)"

Searched online and found a couple of sk and posts regarding this error. But all of them are not same as my scenario. Eventually with an open case, Checkpoint support send me those commands fixed my issue. This post records this for the reference

On both cluster members perform under expert mode:

1. tellpm process:monitord
2. ps aux | grep cpd
3. kill -15 <PID_of_CPD> 
4. tellpm process:monitord t
5. cpwd_admin start -name CPD -path "$CPDIR/bin/cpd" -command "cpd"

Here is the output from my problem devices:
[Expert@CP-DMZ:0]# tellpm process:monitord
[Expert@CP-DMZ:0]#
Message from syslogd@ at Tue Sep 16 10:27:42 2014 ...
CP-M-DMZ monitord[4129]: monitord got killed
[Expert@CP-DMZ:0]#
[Expert@CP-DMZ:0]# ps aux | grep cpd
admin     4461  0.0  0.3 212412  3196 ?        Dsl  Aug06  42:47 cpd
admin     6905  0.0  0.0   1816   492 pts/2    S+   10:27   0:00 grep cpd

[Expert@CP-DMZ:0]# kill -15 4461

[Expert@CP-DMZ:0]#
[Expert@CP-DMZ:0]# tellpm process:monitord t

[Expert@CP-DMZ:0]#
[Expert@CP-DMZ:0]# cpwd_admin start -name CPD -path "$CPDIR/bin/cpd" -command "cpd"
cpwd_admin:
Process CPD started successfully (pid=7030)
[Expert@CP-DMZ:0]#

After that, pushed policy again and this time both cluster member got policy without any error.