Checkpoint Firewall Customization - SIC cpd disable https2

 
For SIC to be established with management Server, endure CPD process on the Security Gateway is has started with E and not terminated T 

[Expert@my-FW:0]# cpwd_admin list
APP        PID    STAT  #START  START_TIME             MON  COMMAND             
FWK_FORKER 103721 E     1       [16:48:07] 27/4/2023   N    fwk_forker          
FWK_WD     103730 E     1       [16:48:07] 27/4/2023   N    fwk_wd -i 43 -i6 0  
CPD        104483 E     1       [16:48:23] 27/4/2023   Y    cpd                 
DASERVICE  126938 E     1       [16:55:53] 27/4/2023   N    DAService_script    
AUTOUPDATER 121008 E     1       [16:49:18] 27/4/2023   N    AutoUpdaterService.sh
CPVIEWD    104461 E     1       [16:48:23] 27/4/2023   N    cpviewd             
LPD        75565  E     1       [16:46:35] 27/4/2023   N    lpd                 
CPVIEWS    104466 E     1       [16:48:23] 27/4/2023   N    cpview_services     
SXL_STATD  104469 E     1       [16:48:23] 27/4/2023   N    sxl_statd           
MPDAEMON   104496 E     1       [16:48:23] 27/4/2023   N    mpdaemon /opt/CPshrd-R81.10/log/mpdaemon.elg /opt/CPshrd-R81.10/conf/mpdaemon.conf
TP_CONF_SERVICE 104523 E     1       [16:48:23] 27/4/2023   N    tp_conf_service --conf=tp_conf.json --log=error
CXLD       104743 E     1       [16:48:24] 27/4/2023   N    cxld -d             
CI_CLEANUP 104750 E     1       [16:48:24] 27/4/2023   N    avi_del_tmp_files   
CIHS       104757 E     1       [16:48:24] 27/4/2023   N    ci_http_server -j -f /opt/CPsuite-R81.10/fw1/conf/cihs.conf
FWD        104780 E     1       [16:48:24] 27/4/2023   N    fwd                 
SPIKE_DETECTIVE 104787 E     1       [16:48:24] 27/4/2023   N    spike_detective     
DSDEAMON   117031 E     1       [16:49:13] 27/4/2023   Y    dsd                 
[Expert@my-FW:0]# 

To disable https2 or enable https2 

1. Disable HTTP2 Header Length on my-vpn-fwa.mycompany.COM and my-vpn-fwb.mycompany.COM

To disable http2:

ckp_regedit -a SOFTWARE\\CheckPoint\\FW1 IGNORE_ALPN_EXTENSION 1

cpstop;cpstart

To enable http2 again:

ckp_regedit -a SOFTWARE\\CheckPoint\\FW1 IGNORE_ALPN_EXTENSION 0

cpstop;cpstart

VPN TRAC_Client_1 Files

/var/opt/CPsuite-R81.10/fw/conf/trac_client_1.ttm

RSA integration with Checkpoint 

Files are located in /var/ace directory

Must do a cpstop before change files and cpstart after

Initially you need just 2 files sdconf.rec and sdopts.rec file

sdconf.rec, 

sdopts.rec (clientIP) , 

securID (node secret), 

sdstatus.12 (traffic info between FW and Auth Manager)

Migrate Export of Checkpoint Management Server 

[Expert@CP-MGMT01]# cd $FWDIR/bin/upgrade_tools
[Expert@CP-MGMT01]# pwd
/opt/CPsuite-R80.40/fw1/bin/upgrade_tools
[Expert@CP-MGMT01]# cd $HOME
[Expert@CPMGMT01]# yes | nohup ./migrate export /home/admin/CPMGMT01-090622.tgz
nohup: appending output to 'nohup.out'
[Expert@CP-MGMT01]#

• cpinfo -y all
• enabled_blades
• fw stat
• cpinfo from gateway and cpinfo / migrate export from management server