Got a situation which has to remotely configure a factory reset checkpoint 2205 appliance. Unfortunately I have to do basic configuration from remote first until get internal interface configured proper ip, then I am able to run first time wizard to continue set up with new ip address. As we know after checkpoint appliance reset to factory, internal interface is 192.168.1.1.which usually not reachable for my remote access.
Good thing is I have a remote console access through Avocent Console Server 5000 series. I was thinking I can configure internal interface ip first through console. But after entered into console, I found I got into a stuck situation which is no way to issue sysconfig / cpconfig before finish first time wizard through web GUI interface.
After a google search, quickly found this post at
https://www.cpug.org/forums/check-point-utm-1-appliances/10713-setup-utm-1-via-serial-console.html
Two commands can easily resolve my problem now. Get into expert mode, then touch two magic files.
touch /opt/spwm/conf/wizard_accepted
touch /opt/spwm/conf/wizard_post_install.accepted
Then I am able to issue sysconfig to set up Internal interface ip and gateway. After all done, remove those two touched files from expert mode:
rm /opt/spwm/conf/wizard_accepted
rm /opt/spwm/conf/wizard_post_install.accepted
Then I am able to remotely run first time wizard with new ip address. CPUG saved my life again.
Tuesday, April 24, 2012
Sunday, April 1, 2012
Checkpoint SPLAT Manual Proxy ARP Configuration Example
Checkpoint manual NAT configuration is a quite useful method to remedy the weakness of auto nat . For me, I always mix them according to different scenarios although there are quite discussion which is better in a dispute CPUG post. Use auto nat as possible as I can when starting projects or network, then slowly to roll out manually NAT when complexity components added.
Here is a recent scenario which manual NAT used. Client need to use 10.94.30.53 to access DMZ sftp server 172.17.3.53. Auto NAT should be able to resolve it in 30 seconds configuration. Unfortunately, sftp server 172.17.3.53 is facing multiple checkpoint firewalls and it has to be nat-ed to another segment as well. So manually nat will be the only choice here.
1. Enable Manual NAT from global properties
2. Create Manual NAT rule
3. Add manual proxy arp entry into local.arp file
echo "10.94.30.53 AA:BB:CC:DD:EE" >> $FWDIR/conf/local.arp
note: AA:BB:CC:DD:EE is the mac address of your SPLAT firewall 10.94.30.42 interface. If use clustering implementation, all of cluster members local.arp file need to be modified based on member's interface mac address.
4. Push policy to enable NAT rule and merge this manual NAT record into arp table.
5. Verify with fw ctl arp command
[CP-FW]# fw ctl arp
(10.94.30.53) at AA:BB:CC:DD:EE
Here is a recent scenario which manual NAT used. Client need to use 10.94.30.53 to access DMZ sftp server 172.17.3.53. Auto NAT should be able to resolve it in 30 seconds configuration. Unfortunately, sftp server 172.17.3.53 is facing multiple checkpoint firewalls and it has to be nat-ed to another segment as well. So manually nat will be the only choice here.
1. Enable Manual NAT from global properties
2. Create Manual NAT rule
3. Add manual proxy arp entry into local.arp file
echo "10.94.30.53 AA:BB:CC:DD:EE" >> $FWDIR/conf/local.arp
note: AA:BB:CC:DD:EE is the mac address of your SPLAT firewall 10.94.30.42 interface. If use clustering implementation, all of cluster members local.arp file need to be modified based on member's interface mac address.
4. Push policy to enable NAT rule and merge this manual NAT record into arp table.
5. Verify with fw ctl arp command
[CP-FW]# fw ctl arp
(10.94.30.53) at AA:BB:CC:DD:EE
Tuesday, March 13, 2012
Checkpoint SPLAT Timezone Configuration Difference on WebUI and CMD
When setting up Checkpoint Smart-1 / SPLAT / UTM gateway, there is one thing always confusing admin - how to set up correct timezone with daylight saving. Usually WebUI is the first interface to start setting up checkpoint gateway. Unfortunately, the NTP configuration is not that straightforward.
As the screenshot shows, it only allows admin to set time zone to GMT+-12 format. How about daylight saving configuration? Will you change time zone manually twice per year?
The better solution for this is not to use WebUI for NTP settings at all. There is quick wizard configuration method through CLI which listed below including all steps used in our environment.
1. Enter into Expert mode
2. type ntp command to configure NTP source and update frequency.
ntp -n 60 172.1.3.83
note: 172.1.3.83 is our internal NTP server. Gateway will update time every 60 minutes.
3. Sysconfig
Choose a configuration item ('e' to exit):
------------------------------------------------------------------
1) Host name 5) Network Connections 9) Export Setup
2) Domain name 6) Routing 10) Products Installation
3) Domain name servers 7) DHCP Server Configuration 11) Products Configuration
4) Time and Date 8) DHCP Relay Configuration
------------------------------------------------------------------
(Note: configuration changes are automatically saved)
Your choice: 4
Choose a time and date configuration item ('e' to exit):
------------------------------------------------------------------
1) Set time zone 3) Set local time
2) Set date 4) Show date and time settings
------------------------------------------------------------------
(Note: configuration changes are automatically saved)
Your choice: 1
Identify a location so that time zone rules can be set correctly.
Select a continent or ocean.
1) Africa
2) Americas
3) Antarctica
4) Arctic Ocean
5) Asia
6) Atlantic Ocean
7) Australia
8) Europe
9) Indian Ocean
10) Pacific Ocean
11) none - I want to specify the time zone using GMT<+|->N format.
12) cancel - I want to quit without changing the time zone.
#? 2
Select a country.
1) Anguilla 19) El Salvador 37) Puerto Rico
2) Antigua & Barbuda 20) French Guiana 38) St Barthelemy
3) Argentina 21) Greenland 39) St Kitts & Nevis
4) Aruba 22) Grenada 40) St Lucia
5) Bahamas 23) Guadeloupe 41) St Martin (French part)
6) Barbados 24) Guatemala 42) St Pierre & Miquelon
7) Belize 25) Guyana 43) St Vincent
8) Bolivia 26) Haiti 44) Suriname
9) Brazil 27) Honduras 45) Trinidad & Tobago
10) Canada 28) Jamaica 46) Turks & Caicos Is
11) Cayman Islands 29) Martinique 47) United States
12) Chile 30) Mexico 48) Uruguay
13) Colombia 31) Montserrat 49) Venezuela
14) Costa Rica 32) Netherlands Antilles 50) Virgin Islands (UK)
15) Cuba 33) Nicaragua 51) Virgin Islands (US)
16) Dominica 34) Panama 52) cancel
17) Dominican Republic 35) Paraguay
18) Ecuador 36) Peru
#? 10
Select one of the following time zone regions.
1) Newfoundland Time, including SE Labrador
2) Atlantic Time - Nova Scotia (most places), PEI
3) Atlantic Time - Nova Scotia - places that did not observe DST 1966-1971
4) Atlantic Time - New Brunswick
5) Atlantic Time - Labrador - most locations
6) Atlantic Standard Time - Quebec - Lower North Shore
7) Eastern Time - Quebec - most locations
8) Eastern Time - Ontario - most locations
9) Eastern Time - Ontario & Quebec - places that did not observe DST 1967-1973
10) Eastern Time - Thunder Bay, Ontario
11) Eastern Time - east Nunavut - most locations
12) Eastern Time - Pangnirtung, Nunavut
13) Eastern Standard Time - Resolute, Nunavut
14) Eastern Standard Time - Atikokan, Ontario and Southampton I, Nunavut
15) Central Time - central Nunavut
16) Central Time - Manitoba & west Ontario
17) Central Time - Rainy River & Fort Frances, Ontario
18) Central Standard Time - Saskatchewan - most locations
19) Central Standard Time - Saskatchewan - midwest
20) Mountain Time - Alberta, east British Columbia & west Saskatchewan
21) Mountain Time - west Nunavut
22) Mountain Time - central Northwest Territories
23) Mountain Time - west Northwest Territories
24) Mountain Standard Time - Dawson Creek & Fort Saint John, British Columbia
25) Pacific Time - west British Columbia
26) Pacific Time - south Yukon
27) Pacific Time - north Yukon
28) cancel
#? 8
The following information has been given:
Canada
Eastern Time - Ontario - most locations
Therefore TZ='America/Toronto' will be used.
Is the above information OK?
1) Yes
2) No
3) Cancel
#? 1
Updating time zone succeeded.
Time zone is set.
4. verify the configuration
[Expert@CP-1]# cat /etc/sysconfig/ntp
SERVER1=172.1.3.83
SERVER2=
SERVER3=
INTERVAL=60
MD5_SECRET=
USE_NTP=true
[Expert@CP-1]# hwclock --show
Tue Mar 13 22:07:57 2012 -0.147808 seconds
[Expert@CP-1]# date
03-13-2012
[Expert@CP-1]# /bin/date
Tue Mar 13 22:08:14 EDT 2012
[Expert@CP-1]# ntpdate 172.1.3.83
13 Mar 22:55:33 ntpdate[15774]: step time server 172.1.3.83 offset 78.457643 sec
note: ntpdate can be used to update time right away with ntp server.
Update:
There is time configuration difference between WebUI and Command Line, please be aware of this and never touch webui's Date and Time configuration anymore:
From SPLAT box, when you select 4) to show date and time settings, it will show it is EDT (Eastern Daylight Time).
But from webui, it show GMT+0 although time is right. If you change the settings in WebUI, the Command Line configuration will be gone.
----------------------------------------------------------------------------------------------------------
Cisco Switch NTP tip:
The Catalyst 2950, 2955, 3550 and 3560 switches do not have a hardware-supported clock, and they cannot function as an NTP master clock to which peers synchronize themselves when an external NTP source is not available. These switches also have no hardware support for a calendar. As a result, the ntp update-calendar and the ntp master global configuration commands are not available.
The better solution for this is not to use WebUI for NTP settings at all. There is quick wizard configuration method through CLI which listed below including all steps used in our environment.
1. Enter into Expert mode
2. type ntp command to configure NTP source and update frequency.
ntp -n 60 172.1.3.83
note: 172.1.3.83 is our internal NTP server. Gateway will update time every 60 minutes.
3. Sysconfig
Choose a configuration item ('e' to exit):
------------------------------------------------------------------
1) Host name 5) Network Connections 9) Export Setup
2) Domain name 6) Routing 10) Products Installation
3) Domain name servers 7) DHCP Server Configuration 11) Products Configuration
4) Time and Date 8) DHCP Relay Configuration
------------------------------------------------------------------
(Note: configuration changes are automatically saved)
Your choice: 4
Choose a time and date configuration item ('e' to exit):
------------------------------------------------------------------
1) Set time zone 3) Set local time
2) Set date 4) Show date and time settings
------------------------------------------------------------------
(Note: configuration changes are automatically saved)
Your choice: 1
Identify a location so that time zone rules can be set correctly.
Select a continent or ocean.
1) Africa
2) Americas
3) Antarctica
4) Arctic Ocean
5) Asia
6) Atlantic Ocean
7) Australia
8) Europe
9) Indian Ocean
10) Pacific Ocean
11) none - I want to specify the time zone using GMT<+|->N format.
12) cancel - I want to quit without changing the time zone.
#? 2
Select a country.
1) Anguilla 19) El Salvador 37) Puerto Rico
2) Antigua & Barbuda 20) French Guiana 38) St Barthelemy
3) Argentina 21) Greenland 39) St Kitts & Nevis
4) Aruba 22) Grenada 40) St Lucia
5) Bahamas 23) Guadeloupe 41) St Martin (French part)
6) Barbados 24) Guatemala 42) St Pierre & Miquelon
7) Belize 25) Guyana 43) St Vincent
8) Bolivia 26) Haiti 44) Suriname
9) Brazil 27) Honduras 45) Trinidad & Tobago
10) Canada 28) Jamaica 46) Turks & Caicos Is
11) Cayman Islands 29) Martinique 47) United States
12) Chile 30) Mexico 48) Uruguay
13) Colombia 31) Montserrat 49) Venezuela
14) Costa Rica 32) Netherlands Antilles 50) Virgin Islands (UK)
15) Cuba 33) Nicaragua 51) Virgin Islands (US)
16) Dominica 34) Panama 52) cancel
17) Dominican Republic 35) Paraguay
18) Ecuador 36) Peru
#? 10
Select one of the following time zone regions.
1) Newfoundland Time, including SE Labrador
2) Atlantic Time - Nova Scotia (most places), PEI
3) Atlantic Time - Nova Scotia - places that did not observe DST 1966-1971
4) Atlantic Time - New Brunswick
5) Atlantic Time - Labrador - most locations
6) Atlantic Standard Time - Quebec - Lower North Shore
7) Eastern Time - Quebec - most locations
8) Eastern Time - Ontario - most locations
9) Eastern Time - Ontario & Quebec - places that did not observe DST 1967-1973
10) Eastern Time - Thunder Bay, Ontario
11) Eastern Time - east Nunavut - most locations
12) Eastern Time - Pangnirtung, Nunavut
13) Eastern Standard Time - Resolute, Nunavut
14) Eastern Standard Time - Atikokan, Ontario and Southampton I, Nunavut
15) Central Time - central Nunavut
16) Central Time - Manitoba & west Ontario
17) Central Time - Rainy River & Fort Frances, Ontario
18) Central Standard Time - Saskatchewan - most locations
19) Central Standard Time - Saskatchewan - midwest
20) Mountain Time - Alberta, east British Columbia & west Saskatchewan
21) Mountain Time - west Nunavut
22) Mountain Time - central Northwest Territories
23) Mountain Time - west Northwest Territories
24) Mountain Standard Time - Dawson Creek & Fort Saint John, British Columbia
25) Pacific Time - west British Columbia
26) Pacific Time - south Yukon
27) Pacific Time - north Yukon
28) cancel
#? 8
The following information has been given:
Canada
Eastern Time - Ontario - most locations
Therefore TZ='America/Toronto' will be used.
Is the above information OK?
1) Yes
2) No
3) Cancel
#? 1
Updating time zone succeeded.
Time zone is set.
4. verify the configuration
[Expert@CP-1]# cat /etc/sysconfig/ntp
SERVER1=172.1.3.83
SERVER2=
SERVER3=
INTERVAL=60
MD5_SECRET=
USE_NTP=true
[Expert@CP-1]# hwclock --show
Tue Mar 13 22:07:57 2012 -0.147808 seconds
[Expert@CP-1]# date
03-13-2012
[Expert@CP-1]# /bin/date
Tue Mar 13 22:08:14 EDT 2012
[Expert@CP-1]# ntpdate 172.1.3.83
13 Mar 22:55:33 ntpdate[15774]: step time server 172.1.3.83 offset 78.457643 sec
note: ntpdate can be used to update time right away with ntp server.
Update:
There is time configuration difference between WebUI and Command Line, please be aware of this and never touch webui's Date and Time configuration anymore:
From SPLAT box, when you select 4) to show date and time settings, it will show it is EDT (Eastern Daylight Time).
----------------------------------------------------------------------------------------------------------
Cisco Switch NTP tip:
The Catalyst 2950, 2955, 3550 and 3560 switches do not have a hardware-supported clock, and they cannot function as an NTP master clock to which peers synchronize themselves when an external NTP source is not available. These switches also have no hardware support for a calendar. As a result, the ntp update-calendar and the ntp master global configuration commands are not available.
Wednesday, March 7, 2012
Checkpoint Management Center Snapshot, Backup and Log file location
Our management server Smart-1 is running at standalone mode, not have another HA standby for redundancy. If not having a decent backup for disaster recovery, our situation will be dangerous. Usually I do upgrade_export from command line and backup checkpoint from WebUI, then ftp both files out in a safe place. Image file at Smart-1 seems not exportable from appliance.
[Expert@CP-Management]# cd /opt/CPsuite-R75.20/fw1/bin/
or cd $FWDIR/bin
[Expert@CP-Management]# cd upgrade_tools/
[Expert@CP-Management]# dir
migrate migrate.conf upgrade_export upgrade_import
[Expert@CP-Management]# ./upgrade_export
'upgrade_export' and 'upgrade_import' have been replaced by the 'migrate' utility.
Run 'migrate' to export and import the Check Point Security Management Server database.
Running 'migrate export' is equivalent to 'upgrade_export'.
Running 'migrate import' is equivalent to 'upgrade_import'.
[Expert@CP-Management]# cd /opt/CPsuite-R75.20/fw1/bin/
or cd $FWDIR/bin
[Expert@CP-Management]# cd upgrade_tools/
[Expert@CP-Management]# dir
migrate migrate.conf upgrade_export upgrade_import
[Expert@CP-Management]# ./upgrade_export
'upgrade_export' and 'upgrade_import' have been replaced by the 'migrate' utility.
Run 'migrate' to export and import the Check Point Security Management Server database.
Running 'migrate export' is equivalent to 'upgrade_export'.
Running 'migrate import' is equivalent to 'upgrade_import'.
[Expert@CP-Management]# ./migrate export
Use the migrate utility to export and import Check Point Security Management Server database.
Usage: migrate <ACTION> [OPTIONS] <FILE>
Action (required parameter):
export - exports database.
import - imports database.
Options (optional parameters):
-l - Export/import SmartView Tracker logs.
Note: only closed logs are exported/imported.
-n - Run non-interactively
File (required parameter):
Name of archived file to export/import database to/from.
Path to archive should exist.
Path to archive should exist.
Note: Run the utility either from the current directory or using an absolute path.
[Expert@CP-Management]# ./migrate export CP_SMART_20120308
You are required to close all clients to Security Management Server
or execute 'cpstop' before the Export operation begins.
Do you want to continue? (y/n) [n]? y
Copying required files...
Compressing files...
The operation completed successfully.
Location of archive with exported database: /opt/CPsuite-R75.20/fw1/bin/upgrade_tools/CP_SMART_20120308.tgz
Note: After ftp it out, remember to use md5sum to verify md5 value.
Note: After ftp it out, remember to use md5sum to verify md5 value.
----------------------------------------------------------------------
[Expert@CP-Management]# cd $FWDIR/log
[Expert@CP-Management]# ls
2011-04-28_171131.log 2011-10-05_235900.loginitial_ptr 2011-10-16_000000.log 2012-01-01_010000.loginitial_ptr fw.loginitial_ptr john-ips.tar.gz
2011-04-28_171131.logaccount_ptr 2011-10-05_235900.logptr 2011-10-16_000000.logaccount_ptr 2012-01-01_010000.logptr fw.logptr ldap_pid_14310.stats
2011-04-28_171131.loginitial_ptr 2011-10-06_235900.log 2011-10-16_000000.loginitial_ptr 2012-02-01_010000.log fw.logtrack ldap_pid_15171.stats
2011-04-28_171131.logptr 2011-10-06_235900.logaccount_ptr 2011-10-16_000000.logptr 2012-02-01_010000.logaccount_ptr fw.vlog ldap_pid_23124.stats
2011-07-05_102750.log 2011-10-06_235900.loginitial_ptr 2011-10-21_162716.log 2012-02-01_010000.loginitial_ptr fw.vlogaccount_ptr ldap_pid_2410.stats
2011-07-05_102750.logaccount_ptr 2011-10-06_235900.logptr 2011-10-21_162716.logaccount_ptr 2012-02-01_010000.logptr fw.vloginitial_ptr ldap_pid_2416.stats
2011-07-05_102750.loginitial_ptr 2011-10-07_235900.log 2011-10-21_162716.loginitial_ptr 2012-03-01_010000.log fw.vlogptr ldap_pid_2577.stats
2011-07-05_102750.logptr 2011-10-07_235900.logaccount_ptr 2011-10-21_162716.logptr 2012-03-01_010000.logaccount_ptr fwd.elg ldap_pid_2584.stats
2011-10-02_103702.log 2011-10-07_235900.loginitial_ptr 2011-10-23_000000.log 2012-03-01_010000.loginitial_ptr fwd.elg.0 ldap_pid_2585.stats
2011-10-02_103702.logaccount_ptr 2011-10-07_235900.logptr 2011-10-23_000000.logaccount_ptr 2012-03-01_010000.logptr fwd.elg.1 ldap_pid_2594.stats
2011-10-02_103702.loginitial_ptr 2011-10-08_235900.log 2011-10-23_000000.loginitial_ptr BVUuidDB fwd.elg.2 ldap_pid_2599.stats
2011-10-02_103702.logptr 2011-10-08_235900.logaccount_ptr 2011-10-23_000000.logptr actlog.time fwd.elg.3 ldap_pid_2621.stats
2011-10-02_235900.log 2011-10-08_235900.loginitial_ptr 2011-10-30_000000.log connectra_rulenums.html fwd.elg.4 ldap_pid_2622.stats
2011-10-02_235900.logaccount_ptr 2011-10-08_235900.logptr 2011-10-30_000000.logaccount_ptr cpca.elg fwd.elg.5 ldap_pid_2662.stats
2011-10-02_235900.loginitial_ptr 2011-10-09_235900.log 2011-10-30_000000.loginitial_ptr cplmd.elg fwm.elg ldap_pid_2744.stats
2011-10-02_235900.logptr 2011-10-09_235900.logaccount_ptr 2011-10-30_000000.logptr cpmad.err fwm.elg.0 ldap_pid_2760.stats
2011-10-03_235900.log 2011-10-09_235900.loginitial_ptr 2011-11-03_160050.log cpstat_monitor.elg fwm.elg.1 ldap_pid_2851.stats
2011-10-03_235900.logaccount_ptr 2011-10-09_235900.logptr 2011-11-03_160050.logaccount_ptr dbver.elg fwm.elg.2 ldap_pid_30029.stats
2011-10-03_235900.loginitial_ptr 2011-10-10_235900.log 2011-11-03_160050.loginitial_ptr dlp_blob_cache.db fwm.elg.3 ldap_pid_8465.stats
2011-10-03_235900.logptr 2011-10-10_235900.logaccount_ptr 2011-11-03_160050.logptr fw.adtlog fwm.elg.4 ldap_pid_9655.stats
2011-10-04_235900.log 2011-10-10_235900.loginitial_ptr 2011-12-01_010000.log fw.adtlogaccount_ptr fwm.elg.5 log
2011-10-04_235900.logaccount_ptr 2011-10-10_235900.logptr 2011-12-01_010000.logaccount_ptr fw.adtloginitial_ptr fwm.elg.6 status_proxy.elg
2011-10-04_235900.loginitial_ptr 2011-10-11_235900.log 2011-12-01_010000.loginitial_ptr fw.adtlogptr fwm.elg.7 upgrade_log.elg
2011-10-04_235900.logptr 2011-10-11_235900.logaccount_ptr 2011-12-01_010000.logptr fw.log fwm.elg.8
2011-10-05_235900.log 2011-10-11_235900.loginitial_ptr 2012-01-01_010000.log fw.logLuuidDB fwui.log
2011-10-05_235900.logaccount_ptr 2011-10-11_235900.logptr 2012-01-01_010000.logaccount_ptr fw.logaccount_ptr ipscntr.elg
--------------------------------------
Faq: Where is WebUI backup/restore file location?
use find command to find it out:
use find command to find it out:
find / -name \*.tgz -mtime -1 -ls
/var/log/CPbackup/backups/NGX_R65_/xyz.tgz
---------------------------------------
Faq: Where is WebUI image file location? - no location
When an image is created blocks are written to the unpartitioned space, there is no actual file.
note (added on July 20 2012) for re-sizing WebUI Image partition:
Found a good explanation regarding how to resize partition on R75 from Michael Thompson in Linedin Post
"Kernel version 2.6 supports online partition resizing, R75 is at version 2.6, to verify issue the command
uname -r
Depending on your appliance model, it should be outfitted with a 160GB HDD upwards which is should have physical volumes and logical volumes, issue the commands
pvs - to view physical hdd config, take note of vg_splat volume group (VG) and free space available as this would indicate how much your vg_splat/lv_current volume can be resized to
vgs - to view volume groups config, take note of number of logical volumes (LV)
lvs - to view logical volumes
df -h - to view mounted volumes, size, used and free space
Now for resizing
lvresize -L XXGB vg_splat/lv_current
output should say
Extending logical volume lv_current to XX.00 GB
Logical volume lv_current successfully resized
then issue
resize2fs /dev/mapper/vg_splat-lv_current
finally issue vgscan and df -h to verify successful resizing
As a side note, R65 requires offline resizing with a slightly more complicated procedure but can also be done."
note (added on July 20 2012) for re-sizing WebUI Image partition:
Found a good explanation regarding how to resize partition on R75 from Michael Thompson in Linedin Post
"Kernel version 2.6 supports online partition resizing, R75 is at version 2.6, to verify issue the command
uname -r
Depending on your appliance model, it should be outfitted with a 160GB HDD upwards which is should have physical volumes and logical volumes, issue the commands
pvs - to view physical hdd config, take note of vg_splat volume group (VG) and free space available as this would indicate how much your vg_splat/lv_current volume can be resized to
vgs - to view volume groups config, take note of number of logical volumes (LV)
lvs - to view logical volumes
df -h - to view mounted volumes, size, used and free space
Now for resizing
lvresize -L XXGB vg_splat/lv_current
output should say
Extending logical volume lv_current to XX.00 GB
Logical volume lv_current successfully resized
then issue
resize2fs /dev/mapper/vg_splat-lv_current
finally issue vgscan and df -h to verify successful resizing
As a side note, R65 requires offline resizing with a slightly more complicated procedure but can also be done."
Friday, March 2, 2012
Enable Checkpoint SmartWorkflow on Management Server
Just enabled SmartWorkflow and have some steps recorded here to share
Enable SmartWorkflow steps:
2. Create two users , Admin1 and manager. Admin1 is used to perform daily routing work and it is associated with permission profile Admin. manager is in Manager group and will be used to do approval and of course changes.
3. Check License from SmartWorkflow menu:
4. Enable SmartWorkflow from SmartWorkflow dropdown menu:
5. After saved configiration and SmartDashboard restarted, SmartWorkflow Session Management window pops up.
Create a new session, system will automatically build a new database baseline revision for your new session.Depending your revision database size and your management server's power, the revision creating time will take a couple of seconds to one minute.
6. Menu for SmartWorkflow:
7. First change and submit for approval:
Make some changes, and those changes will automatically be highlighted with a vivid green color.
At Submit Session for Approval window, click Submit button. You can add some notes to explain your changes which your approval group may like to see.
Comparing the databases window will show up after submitted your changes. It will run a couple of minutes on my case. Not sure if it is because my smart-1 appliance resource not enough or my revision database is more than 300m.
8. Surprised Session Management window coming up:
I was surprised when this window comes up with approval option. I though SmartWorkflow has segregated the role with task performer and approvals. It seems normal admin user can approval themselves.
9. Change SmartWorkflow settings on Global Properties:
Refer Documentation:
http://supportcontent.checkpoint.com/documentation_download?ID=12283
Enable SmartWorkflow steps:
1. Create two Permission Profiles for normal administrators and managers. Only difference is Manager profile has manage administrators permission.
2. Create two users , Admin1 and manager. Admin1 is used to perform daily routing work and it is associated with permission profile Admin. manager is in Manager group and will be used to do approval and of course changes.
3. Check License from SmartWorkflow menu:
4. Enable SmartWorkflow from SmartWorkflow dropdown menu:
5. After saved configiration and SmartDashboard restarted, SmartWorkflow Session Management window pops up.
Create a new session, system will automatically build a new database baseline revision for your new session.Depending your revision database size and your management server's power, the revision creating time will take a couple of seconds to one minute.
6. Menu for SmartWorkflow:
Make some changes, and those changes will automatically be highlighted with a vivid green color.
8. Surprised Session Management window coming up:
I was surprised when this window comes up with approval option. I though SmartWorkflow has segregated the role with task performer and approvals. It seems normal admin user can approval themselves.
9. Change SmartWorkflow settings on Global Properties:
This time looks better. Normal admin could not have option to approve themselves now.
10. Log in SmartDashboard again with manager account. You will see there is a session waiting approve, clieck approve button. Then it will show approved. Save Changes. Then you can either open a new session or go ahead without session to push policy, either exit SmartDashboard.
11. Remember, there is always only one in process session exist. If you quit your session without send an approval request. Once somebody else logged in, either he continue your session or he open a new session for himself.
Refer Documentation:
http://supportcontent.checkpoint.com/documentation_download?ID=12283
Subscribe to:
Posts (Atom)