Test
Monday 18 October 2021
Thursday 15 July 2021
How to do tcpdump excluding something?
Lets take an example, I want to do tcpdump for all traffic on any interface but I dont want to capture ssh traffic.
This is how you can do it:
sudo tcpdump --interface any ! port 22
Hope this helps someone!
Thursday 12 December 2019
IPSEC 6 packet Exchange? What information is shared in 1st packet of IKE exchange?
What are cookies in IKE Exchange?
What are cookies in IKE Exchange?
Please watch below video to understand what are cookies? What do they do? How are they generated?
Please watch below video to understand what are cookies? What do they do? How are they generated?
Tuesday 19 November 2019
How to remove config lock in Checkpoint IPSO?
How to remove config lock in Checkpoint IPSO?
I was trying to set clock on my checkpoint firewall but it was letting me do that. Every time I enter the set command it gives me error, config-lock has been taken by another user. I couldn't figure out the other user. So I had to remove the config lock with following steps:
NokiaIPSO25>set config-lock on override
NokiaIPSO25>set config-lock off
NokiaIPSO25>exit
Now you have rights to make the changes.
"set config-lock on override" is similar to "lock database override"
"set config-lock off" is similar to "unlock database"
I hope it helps!
I was trying to set clock on my checkpoint firewall but it was letting me do that. Every time I enter the set command it gives me error, config-lock has been taken by another user. I couldn't figure out the other user. So I had to remove the config lock with following steps:
NokiaIPSO25>set config-lock on override
NokiaIPSO25>set config-lock off
NokiaIPSO25>exit
Now you have rights to make the changes.
"set config-lock on override" is similar to "lock database override"
"set config-lock off" is similar to "unlock database"
I hope it helps!
Tuesday 6 August 2019
What is the location for log files in Checkpoint R80?
What is the location for log files in Checkpoint R80?
I just upgraded my checkpoint to R80.10. It was on R77.20 earlier. After few days I started to see alerts on solar wind about log space to be over utilized.
So I checked the usual location for log folder but did not find any log file there. The usual location is :
But there was nothing. It was because of the old log files I had when I was running 77.20. So I started looking for that location. And here it is for you:
/var/log/opt/CPsuite-R77/fw1/log
This location has the old log files that were present while you were running old OS.
I just upgraded my checkpoint to R80.10. It was on R77.20 earlier. After few days I started to see alerts on solar wind about log space to be over utilized.
So I checked the usual location for log folder but did not find any log file there. The usual location is :
/opt/CPsuite-R77/fw1/log
But there was nothing. It was because of the old log files I had when I was running 77.20. So I started looking for that location. And here it is for you:
/var/log/opt/CPsuite-R77/fw1/log
This location has the old log files that were present while you were running old OS.
Monday 22 April 2019
WinSCP " Connection has been unexpectedly closed" while accessing your checkpoint firewall.
For WinSCP to work, change shell to “BASH”
When you get the below error logging into WinSCP, you
know what is the problem. You need to change the shell to BASH.
WinSCP needs bash.
Here is how to fix it?
1. Login to your gateway/firewall using admin/or the username that you are using while logging into WinSCP.
2. Go to Expert mode
3. Chsh –s /bin/bash
You can also visit:
How to verify the current shell for checkpoint?
How to change Shell in checkpoint? / How to change shell to bash and then back to clish?
I hope this has been helpful to you. Please care to share using below social media icons.
https://tools.zscaler.com/upload/
Password - Z9VEp5NCVxpLdFU
How to verify the current shell for checkpoint?
Do you need to know what shell your checkpoint firewall currently has?
Login to your gateway using admin
Go to Expert mode
Login to your gateway using admin
Go to Expert mode
You can use the below command to check what the
current shell mode is:
egrep admin /etc/passwd
The output will be like this:
I hope this has been helpful to you. Please care to share using below social media icons.
Subscribe to:
Posts (Atom)
