Author: krrunch

Posted on

Daemons and Processes

Checkpoint Daemons and Processes

This article describes the different Checkpoint daemons and processes you may see running and what they are responsible for.

Gaia Processes and Daemons

All Gaia processes and daemons run by default, other than snmpd and dhcpd.

Daemon Child daemon Description To Start To Stop
pm Gaia OS Process Manager. Controls other processes and daemons.
confd Database and configuration. From Expert shell:
tellpm process:confd t		 From Expert shell:
tellpm process:confd
searchd Search indexing daemon. From Expert shell:
tellpm process:searchd t		 From Expert shell:
tellpm process:searchd
clishd Gaia Clish CLI interface process – general information for all Clish sessions. From Expert shell:
tellpm process:clishd t		 From Expert shell:
tellpm process:clishd
clish Gaia Clish CLI interface process – Clish process per session. From Expert shell:
tellpm process:clish t		 From Expert shell:
tellpm process:clish
routed Routing daemon. From Expert shell:
tellpm process:routed t		 From Expert shell:
tellpm process:routed
httpd2 Web server daemon (Gaia Portal). From Expert shell:
tellpm process:httpd2 t		 From Expert shell:
tellpm process:httpd2
monitord Hardware monitoring daemon. From Expert shell:
tellpm process:monitord t		 From Expert shell:
tellpm process:monitord
rconfd Provisioning daemon. From Expert shell:
tellpm process:rconfd t		 From Expert shell:
tellpm process:rconfd
cloningd Cloning Groups daemon. From Expert shell:
tellpm process:cloningd t		 From Expert shell:
tellpm process:cloningd
dhcpd DHCP server daemon. From Clish:
set dhcp server enable
or
use Gaia Portal		 From Clish:
set dhcp server disable
or
use Gaia Portal
snmpd SNMP (Linux) daemon. From Clish:
set snmp agent on
or
use Gaia Portal		 From Clish:
set snmp agent off
or
use Gaia Portal
sshd SSH daemon. From Expert shell:
service sshd start		 From Expert shell:
service sshd stop
syslogd Syslog (Linux) daemon. From Expert shell:
service syslog start		 From Expert shell:
service syslog stop
DAService CPUSE (former ‘Gaia Software Updates’) service (sk98926 and sk92449). From Expert shell,
run these 2 commands:
$DADIR/bin/dastart
and
dbget installer:start		 From Expert shell,
run these 2 commands:
$DADIR/bin/dastop
and
dbget installer:stop

Other Gaia daemons can be stopped in Expert mode, but we do not recommend doing so.

 

Infrastructure Processes

Daemon Description To Start To Stop
cpwd WatchDog is a process that launches and monitors critical processes such as Check Point daemons on the local machine, and attempts to restart them if they fail. Among the processes monitored by Watchdog are cpd, fwd and fwm. Watchdog is controlled by the cpwd_admin utility. To learn how to start and stop various daemons, run cpwd_admin command. From Expert shell:
cpstart
or
cpwd_admin start_monitor		 From Expert shell:
cpstop
or
cpwd_admin stop_monitor
cpd
  • Port 18191 – Generic process (add-ons container) for many Check Point services, such as installing and fetching policy, and online updates
  • Port 18211 – SIC push certificate (from Internal CA)

Note: ‘cpwd_admin list‘ command shows the process as “CPD“.

 MGMT / Gateway mode – from Expert shell:
cpstart
or
cpwd_admin start -name CPD -path "$CPDIR/bin/cpd" -command "cpd"VSX mode – from Expert shell:
[Expert@HostName:0]# cpstart
or
[Expert@HostName:0]# vsenv VSID
[Expert@HostName:VSID]# cpwd_admin start -name CPD -ctx VSID -path "$CPDIR/bin/cpd" -command "cpd" -env inherit		 MGMT / Gateway mode – from Expert shell:
cpstop
or
cpwd_admin stop -name CPD -path "$CPDIR/bin/cpd_admin" -command "cpd_admin stop"VSX mode – from Expert shell:
[Expert@HostName:0]# cpstop
or
[Expert@HostName:0]# vsenv VSID
[Expert@HostName:VSID]# cpwd_admin stop -name CPD -ctx VSID -path "$CPDIR/bin/cpd_admin" -command "cpd_admin stop" -env inherit
fwd
  • Logging.
  • Spawning child processes (e.g., vpnd)

Note: ‘cpwd_admin list‘ command shows the process as “FWD“.

 MGMT / Gateway mode – from Expert shell:
cpstart
or
cpwd_admin start -name FWD -path "$FWDIR/bin/fwd" -command "fwd"VSX mode – from Expert shell:
[Expert@HostName:0]# cpstart
or
[Expert@HostName:0]# vsenv VSID
[Expert@HostName:VSID]# cpwd_admin start -name FWD -ctx VSID -path "$FWDIR/bin/fwd" -command "fwd" -env inherit		 Gateway mode – from Expert shell:
cpstop
or
cpwd_admin stop -name FWD -path "$FWDIR/bin/fw" -command "fw kill fwd"VSX mode – from Expert shell:
[Expert@HostName:0]# cpstop
or
[Expert@HostName:0]# vsenv VSID
[Expert@HostName:VSID]# cpwd_admin stop -name FWD -ctx VSID -path "$FWDIR/bin/fw" -command "fw kill fwd" -env inherit

 

Security Gateway Software Blades

Daemon Description To Start To Stop
Firewall Blade
fwd
  • Logging.
  • Spawning child processes (e.g., vpnd)

Note: ‘cpwd_admin list‘ command shows the process as “FWD“.

 Gateway mode – from Expert shell:
cpstart
or
cpwd_admin start -name FWD -path "$FWDIR/bin/fwd" -command "fwd"VSX mode – from Expert shell:
[Expert@HostName:0]# cpstart
or
[Expert@HostName:0]# vsenv VSID
[Expert@HostName:VSID]# cpwd_admin start -name FWD -ctx VSID -path "$FWDIR/bin/fwd" -command "fwd" -env inherit		 Gateway mode – from Expert shell:
cpstop
or
cpwd_admin stop -name FWD -path "$FWDIR/bin/fw" -command "fw kill fwd"VSX mode – from Expert shell:
[Expert@HostName:0]# cpstop
or
[Expert@HostName:0]# vsenv VSID
[Expert@HostName:VSID]# cpwd_admin stop -name FWD -ctx VSID -path "$FWDIR/bin/fw" -command "fw kill fwd" -env inherit
IPSec VPN Blade
vpnd
  • IKE (UDP/TCP)
  • SSL Network Extender
  • Remote Access Client configuration
  • Visitor Mode
  • NAT-T
  • Tunnel test
  • Topology Update for SecureClient
  • RDP
  • L2TP
 From Expert shell:
cpstart		 From Expert shell:
cpstop
Mobile Access Blade
cvpnd Back-end daemon of the Mobile Access Software Blade.
Note: ‘cpwd_admin list‘ command shows the process as “CVPND“.		 From Expert shell:
cvpnstart		 From Expert shell:
cvpnstop
dbwriter Offload database commands from cvpnd (to prevent locks) and syncronize with other members.
Note: ‘cpwd_admin list‘ command shows the process as “DBWRITER“.		 From Expert shell:
cvpnstart		 From Expert shell:
cvpnstop
cvpnproc Offload blocking commands from cvpnd (to prevent locks). Example: sending DynamicID.
Note: ‘cpwd_admin list‘ command shows the process as “CVPNPROC“.		 From Expert shell:
cvpnstart		 From Expert shell:
cvpnstop
MoveFileServer Move files between cluster members in order to perform database synchronization.
Note: ‘cpwd_admin list‘ command shows the process as “MOVEFILESERVER“.		 From Expert shell:
cvpnstart		 From Expert shell:
cvpnstop
Pinger Offload long-lasting requests from httpd.
Note: ‘cpwd_admin list‘ command shows the process as “PINGER“.		 From Expert shell:
cvpnstart		 From Expert shell:
cvpnstop
CvpnUMD Report SNMP connected users to AMON.
Note: ‘cpwd_admin list‘ command shows the process as “CVPNUMD“.		 From Expert shell:
cvpnstart		 From Expert shell:
cvpnstop
httpd Front-end daemon of the Mobile Access Software Blade (multi-processes). From Expert shell:
cvpnstart		 From Expert shell:
cvpnstop
Identity Awareness Blade
pepd Policy Enforcement Point daemon

  • Receiving identities via identity sharing
  • Redirecting users to Captive Portal

Note: ‘cpwd_admin list‘ command shows the process as “PEPD“.

 From Expert shell:
cpstart		 From Expert shell:
cpstop
pdpd Policy Decision Point daemon

  • Acquiring identities from identity sources
  • Sharing identities with another gateways

Note: ‘cpwd_admin list’ command shows the process as “PDPD”.

 From Expert shell:
cpstart		 From Expert shell:
cpstop
DLP Blade
fwdlp DLP core engine that performs the scanning / inspection. From Expert shell:
cpstart		 From Expert shell:
cpstop
cp_file_convert Used to convert various file formats to simple textual format for scanning by the DLP engine. From Expert shell:
cpstart		 From Expert shell:
cpstop
dlp_fingerprint Used to identify the data according to a unique signature known as a fingerprint stored in your repository. From Expert shell:
cpstart		 From Expert shell:
cpstop
cserver Check Server that either stops or processes the e-mail.
Note: ‘cpwd_admin list‘ command shows the process as “DLP_WS“.		 From Expert shell:
cpstart		 From Expert shell:
cpstop
dlpu Receives data from Check Point kernel.
Note: ‘cpwd_admin list‘ command shows the process as “DLPU_N“.		 From Expert shell:
cpstart		 From Expert shell:
cpstop
fwucd UserCheck back-end daemon that sends approval / disapproval requests to user.
Note: ‘cpwd_admin list‘ command shows the process as “FWUCD“.		 From Expert shell:
cpstart		 From Expert shell:
cpstop
Threat Emulation Blade
ted Threat Emulation daemon engine – responsible for emulating files and communication with the cloud. From Expert shell:
cpstart		 From Expert shell:
cpstop
dlpu DLP process – receives data from Check Point kernel.
Note: ‘cpwd_admin list‘ command shows the process as “DLPU_N“.		 From Expert shell:
cpstart		 From Expert shell:
cpstop
IPS Blade
in.geod Updates the IPS Geo Protection Database. After being killed, it will be restarted automatically From Expert shell:
kill -KILL $(pidof in.geod)
URL Filtering Blade
rad Resource Advisor – responsible for the detection of Social Network widgets. The detection is done via an online service available at Check Servers which identifies specific URLs as applications.
Note: ‘cpwd_admin list‘ command shows the process as “RAD“.		 cpstart
or
rad_admin start		 cpstop
or
rad_admin stop
Anti-Bot Blade
acapd Packet capturing daemon for SmartView Tracker logs. cpstart cpstop
rad Resource Advisor – responsible for the detection of Social Network widgets. The detection is done via an online service available at Check Servers which identifies specific URLs as applications.
Note: ‘cpwd_admin list‘ command shows the process as “RAD“.		 cpstart
or
rad_admin start		 cpstop
or
rad_admin stop
Anti-Virus Blade
acapd Packet capturing daemon for SmartView Tracker logs. From Expert shell:
cpstart		 From Expert shell:
cpstop
dlpu DLP process – receives data from Check Point kernel.
Note: ‘cpwd_admin list‘ command shows the process as “DLPU_N“.		 From Expert shell:
cpstart		 From Expert shell:
cpstop
rad Resource Advisor – responsible for the detection of Social Network widgets. The detection is done via an online service available at Check Servers which identifies specific URLs as applications.
Note: ‘cpwd_admin list‘ command shows the process as “RAD“.		 From Expert shell:
cpstart
or
rad_admin start		 From Expert shell:
cpstop
or
rad_admin stop
Anti-Spam Blade
in.emaild.smtp SMTP Security Server that receives e-mails sent by user. From Expert shell:
cpstart		 From Expert shell:
cpstop
msd Mail Security Daemon that queries the Commtouch engine for reputation. From Expert shell:
cpstart		 From Expert shell:
cpstop
ctasd Commtouch Anti-Spam daemon. From Expert shell:
cpstart		 From Expert shell:
cpstop
ctipd Commtouch IP Reputation daemon. From Expert shell:
cpstart		 From Expert shell:
cpstop
Monitoring Blade
rtmd Real Time traffic statistics.
Note: ‘cpwd_admin list‘ command shows the process as “RTMD“.		 From Expert shell:
rtmstart		 From Expert shell:
rtmstop
cpstat_monitor Process is responsible for SmartView Monitor.
Note: ‘cpwd_admin list‘ command shows the process as “CPSM“.		 From Expert shell:
cpwd_admin start -name CPSM -path "$FWDIR/bin/cpstat_monitor" -command "cpstat_monitor"		 From Expert shell:
cpwd_admin stop -name CPSM
HTTPS Inspection
wstlsd
 Handles SSL handshake for HTTPS Inspected connections. From Expert shell:
cpstart		 From Expert shell:
cpstop
pkxld Performs asymmetric key operations for HTTPS Inspection (R77.30 and above) From Expert shell:
cpstart		 From Expert shell:
cpstop

 

Security Management Software Blades

Daemon Description To Start To Stop
Network Policy Management Blade
fwm Communication between SmartConsole applications and Security Management Server.
Note: ‘cpwd_admin list‘ command shows the process as “FWM“.		 From Expert shell:
cpwd_admin start -name FWM -path "$FWDIR/bin/fwm" -command "fwm"		 From Expert shell:
cpwd_admin stop -name FWM -path "$FWDIR/bin/fw" -command "fw kill fwm"
Endpoint Policy Management Blade
epm Endpoint Management Server. From Expert shell:
uepm_start		 From Expert shell:
uepm_stop
httpd Communication with Endpoint Clients. From Expert shell:
uepm_start		 From Expert shell:
uepm_stop
Monitoring Blade
rtmd Real Time traffic statistics.
Note: ‘cpwd_admin list‘ command shows the process as “RTMD“.		 From Expert shell:
rtmstart		 From Expert shell:
rtmstop
cpstat_monitor Process is responsible for SmartView Monitor.
Note: ‘cpwd_admin list‘ command shows the process as “CPSM“.		 From Expert shell:
cpwd_admin start -name CPSM -path "$FWDIR/bin/cpstat_monitor" -command "cpstat_monitor"		 From Expert shell:
cpwd_admin stop -name CPSM
Provisioning Blade
status_proxy Status collection of ROBO Gateways – SmartLSM/SmartProvisioning status proxy. This process runs only on Security Management Server / Domain Management Servers that are activated for Large Scale Management.
Note: ‘cpwd_admin list‘ command shows the process as “SPTR“.		 From Expert shell:
cpstart
or
cpwd_admin start -name STPR -path "$FWDIR/bin/status_proxy" -command "status_proxy"		 From Expert shell:
cpstop
or
cpwd_admin stop -name STPR
SmartReporter Blade
SVRServer Controller for the SmartReporter product. Traffic is sent via SSL.
Note: ‘cpwd_admin list‘ command shows the process as “SVR“.		 From Expert shell:
rmdstart
or
cpwd_admin start -name SVR -path "$RTDIR/bin/SVRServer" -command "SVRServer"		 From Expert shell:
rmdstop
or
cpwd_admin stop -name SVR -path $RTDIR/bin/SVRServer -command "SVRServer kill SVRServer"
log_consolidator Log Consolidator for the SmartReporter product.
Note: ‘cpwd_admin list‘ command shows the process as “LC_<IP Address of Log Server>“.		 From Expert shell:
rmdstart
or
evstart
or
log_consolidator -C -m start -s <IP Address of Log Server> [-g <Domain Name>]		 From Expert shell:
rmdstop
or
evstop
or these 2 commands
log_consolidator -C -m stop -s <IP Address of Log Server> [-g <Domain Name>]
and
log_consolidator -C -m exit -s <IP Address of Log Server> [-g <Domain Name>]
dbsync DBsync enables SmartReporter to synchronize data stored in different parts of the network. After SIC is established, DBsync connects to the management server to retrieve all the objects. After the initial synchronization, it gets updates whenever an object is saved. In distributed information systems DBsync provides one-way synchronization of data between the Security Management Servers object database and the SmartReporter computer, and supports configuration and administration of distributed systems.
Note: ‘cpwd_admin list‘ command shows the process as “DBSYNC“.		 From Expert shell:
rmdstart
or
evstart
or
cpwd_admin start -name DBSYNC -path "$RTDIR/bin/dbsync" -command "dbsync"		 From Expert shell:
rmdstop
or
evstop
or
cpwd_admin stop -name DBSYNC
postgres PostgreSQL server. From Expert shell:
cpstart		 From Expert shell:
cpstop
SmartEvent Blade
cpsead Responsible for Correlation Unit functionality.
Note: ‘cpwd_admin list‘ command shows the process as “CPSEAD“.		 From Expert shell:
evstart
or
cpwd_admin start -name CPSEAD -path "$RTDIR/bin/cpsead" -command "cpsead"		 From Expert shell:
evstop
or
cpwd_admin stop -name CPSEAD
cpsemd Responsible for logging into the SmartEvent GUI.
Note: ‘cpwd_admin list‘ command shows the process as “CPSEMD“.		 From Expert shell:
evstart
or
cpwd_admin start -name CPSEMD -path "$RTDIR/bin/cpsemd" -command "cpsemd"		 From Expert shell:
evstop
or
cpwd_admin stop -name CPSEMD
dbsync DBsync enables SmartEvent to synchronize data stored in different parts of the network. In distributed information systems DBsync provides one-way synchronization of data between the Security Management Servers object database and the SmartEvent computer, and supports configuration and administration of distributed systems. DBsync initially connects to the Management Server, with which SIC is established. It retrieves all the objects and after the initial synchronization it gets updates whenever an object is saved.
Note: ‘cpwd_admin list‘ command shows the process as “DBSYNC“.		 From Expert shell:
evstart
or
cpwd_admin start -name DBSYNC -path "$RTDIR/bin/dbsync" -command "dbsync"		 From Expert shell:
evstop
or
cpwd_admin stop -name DBSYNC
postgres PostgreSQL server. From Expert shell:
cpstart		 From Expert shell:
cpstop
Logging & Status Blade
cplmd In order to get the data that should be presented in SmartView Tracker, FWM spawns a child process CPLMD, which reads the information from the log file and performs unification (if necessary). Upon receiving an answer from CPLMD, FWM transfers it to SmartView Tracker. From Expert shell:
cpstart		 From Expert shell:
cpstop
Management Portal
cpwmd Check Point Web Management Daemon – back-end for Management Portal / SmartPortal.
Note: ‘cpwd_admin list‘ command shows the process as “CPWMD“.		 From Expert shell:
cpwd_admin start -name CPWMD -path "$WEBDIR/bin/cpwmd" -command "cpwmd -D -app SmartPortal"		 From Expert shell:
cpwd_admin stop -name CPWMD
cp_http_server HTTP Server for Management Portal (SmartPortal) and for OS WebUI.
Note: ‘cpwd_admin list‘ command shows the process as “CPHTTPD“.		 From Expert shell:
cpwd_admin start -name CPHTTPD -path "$WEBDIR/bin/cp_http_server" -command "cp_http_server -f '$MPDIR/conf/cp_httpd_admin.conf'"		 From Expert shell:
cpwd_admin stop -name CPHTTPD
SmartLog
smartlog_server SmartLog product.
Note: ‘cpwd_admin list‘ command shows the process as “SMARTLOG_SERVER“.		 From Expert shell:
smartlogstart		 From Expert shell:
smartlogstop
Internal CA
cpca Check Point Internal Certificate Authority:

  • SIC certificate pulling
  • Certificate enrollment
  • CRL fetch
  • Admin WebUI
 From Expert shell:
cpstart		 From Expert shell:
cpstop
SofaWare Management Server
sms Manages communication (status collection, logs collection, policy update, configuration update) with UTM-1 Edge Security Gateways. This process runs only on Security Management Server / Multi-Domain Security Management Servers that manage UTM-1 Edge devices.
Note: ‘cpwd_admin list‘ command shows the process as “VPN-1 Embedded Connector“.		 From Expert shell:
smsstart		 From Expert shell:
smsstop

 

Additional Processes

Daemon Description To Start To Stop
mpdaemon On Security Gateway and Management Server.
Platform Portal / Multi Portal (https://IP_Address/).
Each portal has his own Apache server (which can have multiple processes).
‘mpdaemon‘ process is responsible for starting these web servers.
Note: ‘cpwd_admin list‘ command shows the process as “MPDAEMON“.		 From Expert shell:
cpwd_admin start -name MPDAEMON -path "$CPDIR/bin/mpdaemon" -command "mpdaemon $CPDIR/log/mpdaemon.elg $CPDIR/conf/mpdaemon.conf"		 From Expert shell:
cpwd_admin stop -name MPDAEMON
or
mpclient stopall
avi_del_tmp_files On Security Gateway and Management Server.
Shell script (from ‘$FWDIR/bin/‘) that periodically deletes various old temporary Anti-Virus files.
Note: ‘cpwd_admin list‘ command shows the process as “CI_CLEANUP“.		 From Expert shell:
cpwd_admin start -name CI_CLEANUP -path $FWDIR/bin/avi_del_tmp_files -command "avi_del_tmp_files"		 From Expert shell:
cpwd_admin stop -name CI_CLEANUP
ci_http_server On Security Gateway.
HTTP Server for Content Inspection.
Note: ‘cpwd_admin list‘ command shows the process as “CIHS“.		 From Expert shell:
cpwd_admin start -name CIHS -path $FWDIR/bin/ci_http_server -command "ci_http_server -j -f $FWDIR/conf/cihs.conf"		 From Expert shell:
cpwd_admin stop -name CIHS
cpviewd On Security Gateway and Management Server.
CPView Utility daemon (sk101878).
Note: ‘cpwd_admin list‘ command shows the process as “CPVIEWD“.		 From Expert shell:
cpwd_admin start -name CPVIEWD -path "$FWDIR/bin/cpviewd" -command "cpviewd"		 From Expert shell:
cpwd_admin stop -name CPVIEWD
cpview_historyd On Security Gateway and Management Server.
CPView Utility History daemon (sk101878).
Note: ‘cpwd_admin list‘ command shows the process as “HISTORYD“.		 From Expert shell:
cpview history on		 From Expert shell:
cpview history off
cp_http_server On Security Gateway and Management Server.
HTTP Server for OS WebUI and Management Portal (SmartPortal).
Note: ‘cpwd_admin list‘ command shows the process as “CPHTTPD“.		 From Expert shell:
cpwd_admin start -name CPHTTPD -path "$WEBDIR/bin/cp_http_server" -command "cp_http_server -f '$MPDIR/conf/cp_httpd_admin.conf'"		 From Expert shell:
cpwd_admin stop -name CPHTTPD
cpsnmpd On Security Gateway and Management Server.

  • Listens on UDP port 260 and is capable of responding to SNMP queries for Check Point OIDs only (under OID .1.3.6.1.4.1.2620)
  • Accepts only SNMPv1
  • Supplied as a part of Check Point Suite ($CPDIR/bin/cpsnmpd)
 From Expert shell:
cpsnmpd -p 260		 From Expert shell:
killall cpsnmpd
Posted on

Regenerate the Internal CA Without Breaking SIC

Regenerate the Internal CA Without Breaking SIC

The internal CA certificate expires after 5 years, meaning that if you don’t catch this in time you won’t be able to log into the dashboard or the web UI. You can of course reset SIC on the command line using cpconfig but you will have to re-establish SIC with all your gateways which may be a lot of bother – besides that, any site-to-site or client certificate-based VPNs will also break. This article describes how to regenerate the internal CA without breaking SIC.

This is done on the command line and once completed (a matter of 5 minutes or less) then you will be able to log back in with SmartDashboard and push policies to all your managed gateways; all your certificate-based VPN operations will, quite happily, be none the wiser.

This example is from a R75.20 installation but is common to all up to R77.xx.

On the management station:

Enter expert mode and issue the following commands:

  1. Find the path to your existing (expired) certificate: 
    [Expert@mgmt]# find / -name "sic_cert.p12"
/var/opt/CPshrd-R75.20/conf/sic_cert.p12
[Expert@mgmt]
  2. Revoke the certificate: 
    [Expert@mgmt]# cpca_client revoke_cert -n “CN=cp_mgmt”
  3. Create a new certificate based on the old one 
    cpca_client create_cert -n “CN=cp_mgmt” -f /var/opt/CPshrd-R75.20/conf/sic_cert.p12
  4. Restart your Checkpoint services 
    [Expert@mgmt]# cpstop 
[Expert@mgmt]# cpstart

You should now be able to log in with SmartDashboard and everything else which relies on SIC!

Posted on

CCSE Revision Questions 156-315.77

Checkpoint Certified Security Expert (CCSE) Revision Questions 156-315.77

As a trainer, many conversations I have with delegates revolve around explaining why the “guaranteed pass” answers are not just wrong but ridiculously wrong. Here in these posts, I include explanations as to why a particular answer is correct as opposed to expecting someone to take my word for it as the other cowboy exam prep people do.

 

QUESTION 1

Control connections between the Security Management Server and the Gateway are not
encrypted by the VPN Community. How are these connections secured?

A. They are encrypted and authenticated using SIC.
B. They are not encrypted, but are authenticated by the Gateway
C. They are secured by PPTP
D. They are not secured.

[su_spoiler title=”Answer:” style=”default”] A

Explanation: SIC is based on certificates. When your Security Management Server (SMS) is initially loaded, part of the post-installation is the initialization of the Internal Certificate Authority (ICA). The SMS is a full-featured certificate authority and the first thing the ICA does is create a certificate for itself (the “SMS-Cert”). From that point on all communication between the SMS and Security Gateway is authenticated and encrypted using SMS-Cert & FW-Cert and trust has been established between the two entities.[/su_spoiler]

QUESTION 2

If Bob wanted to create a Management High Availability configuration, what is the minimum
number of Security Management servers required in order to achieve his goal?

A. Three
B. Two
C. Four
D. One

[su_spoiler title=”Answer:” style=”default”]B

Explanation:[/su_spoiler]

QUESTION 3

David wants to manage hundreds of gateways using a central management tool. What tool would
David use to accomplish his goal?

A. SmartProvisioning
B. SmartBlade
C. SmartDashboard
D. SmartLSM

[su_spoiler title=”Answer:” style=”default”]A

Explanation:[/su_spoiler]

QUESTION 4

You find that Gateway fw2 can NOT be added to the cluster object. What are possible reasons for that?
1) fw2 is a member in a VPN community.
2) ClusterXL software blade is not enabled on fw2.
3) fw2 is a DAIP Gateway.

A. 2 or 3
B. 1 or 2
C. 1 or 3
D. All

[su_spoiler title=”Answer:” style=”default”] C
Explanation:

A gateway must first be removed from a VPN community before adding it to a cluster
ClusterXL is automatically enabled on the cluster object
It is not possible to create a cluster with DHCP on the external interface(s)
[/su_spoiler]

QUESTION 5

Review the Rule Base displayed. For which rules will the connection templates be generated in SecureXL?

18[1]
A. Rules 2 and 5
B. Rules 2 through 5
C. Rule 2 only
D. All rules except Rule 3
[su_spoiler title=”Answer:” style=”default”] D

Explanation:

[/su_spoiler]

QUESTION 6

In the following cluster configuration; if you reboot sglondon_1 which device will be active when
sglondon_1 is back up and running? Why?

sglondon_2
sglondon_1

A. Sglondon_1, because it is up again, sglondon_2 took over during reboot
B. Sglondon_2 because I has highest IP
C. Sglondon_2 because it has highest priority
D. Sglondon_1 because it the first configured object with the lowest IP

[su_spoiler title=”Answer:” style=”default”] C
Explanation:

The first gateway listed has the highest initial priority, therefore:

A is incorrect as Sglondon_1 would not take over a higher priority gateway
B is nonsense – priority is never measured by IP
D is nonsense – priority is never measured by IP

[/su_spoiler]

QUESTION 7

Review the Rule Base displayed. For which rules will the connection templates be generated in SecureXL?
A. Rules 2 and 5
B. Rules 2 through 5
C. Rule 2 only
D. All rules except Rule 3

[su_spoiler title=”Answer:” style=”default”] C

Explanation:

Referring to the restrictions below: Rule 3 has a client auth rule – SecureXL connections will not be generated for this and all following rules

—

In general, Connections Templates will be created only for plain UDP or TCP connections. The following restrictions apply for Connection Template generation:

Global restrictions:

SYN Defender — Connection Templates for TCP connections will not be created
VPN connections
Complex connections (H323, FTP, SQL)
NetQuotas
ISN Spoofing

If the Rule Base contains a rule regarding one of the following components, the Connection Templates will be disabled for connections matching this rule, and for all of the following rules:

Security Server connections.
Time objects in the rules.
Dynamic Objects and/or Domain Objects.
Services of type “other” with a match expression.
User/Client/Session Authentication actions.
Services of type RPC/DCERPC/DCOM.

When installing a policy containing restricted rules, you will receive console messages indicating that Connection Templates will not be created due to the rules that have been defined. The warnings should be used as a recommendation that will assist you to fine-tune your policy in order to optimize performance.

[/su_spoiler]

QUESTION 8

You are trying to configure Directional VPN Rule Match in the Rule Base but the Match column does not have the option to see the Directional Match. What must you enable to see the Directional Match?

A. directional_match(true) in the objects_5_0.C file on Security Management Server
B. VPN Directional Match on the Gateway object’s VPN tab
C. VPN Directional Match on the VPN advanced window, in Global Properties
D. Advanced Routing on each Security Gateway

[su_spoiler title=”Answer:” style=”default”] C

Explanation:

For directional VPN enforcement to be configured, it must first be enabled in the Global properties > VPN > Advanced > select Enable VPN directional match in VPN column
[/su_spoiler]

QUESTION 9

MultiCorp is running Smartcenter R71 on an IPSO platform and wants to upgrade to a new Appliance with R77. Which migration tool is recommended?

A. Download Migration Tool R77 for IPSO and Splat/Linux from Check Point website.
B. Use already installed Migration Tool.
C. Use Migration Tool from CD/ISO
D. Fetch Migration Tool R71 for IPSO and Migration Tool R77 for Splat/Linux from CheckPoint website

[su_spoiler title=”Answer:” style=”default”] A

Explanation:

Always use the latest migration tool for the version you are upgrading *to* not from.
[/su_spoiler]

QUESTION 10

MegaCorp is running Smartcenter R70, some Gateways at R65 and some other Gateways with R60. Management wants to upgrade to the most comprehensive IPv6 support. What should the administrator do first?
A. Upgrade Smartcenter to R77 first.
B. Upgrade R60-Gateways to R65.
C. Upgrade every unit directly to R77.
D. Check the ReleaseNotes to verify that every step is supported.

[su_spoiler title=”Answer:” style=”default”] D

Explanation:

These upgrades will need to be done in steps – check each release note for upgrade possibilities and use this upgrade map to check for valid hops.

[/su_spoiler]

QUESTION 11

MicroCorp experienced a security appliance failure. (LEDs of all NICs are off.) The age of the unit required that the RMA-unit be a different model. Will a revert to an existing snapshot bring the new unit up and running?

A. There is no dynamic update at reboot.
B. No. The revert will most probably not match to hard disk.
C. Yes. Everything is dynamically updated at reboot.
D. No. At installation the necessary hardware support is selected. The snapshot saves this state.
[su_spoiler title=”Answer:” style=”default”] D

Explanation:

The question is somewhat ambiguous as there is no mention of whether the old disk has been imported into the new appliance. Regardless of this, A and C dymnamic update doesn’t exist, B would only be applicable if the old HDD had been imported so D is the only viable answer.

The snapshot utility backs up everything, including the drivers, and is available only on SecurePlatform.
Snapshot can be used to backup both your firewall and management modules.
The disadvantages of this utility are that the generated file is very big, and can only be restored to the same device, and exactly the same state (same OS, same Check Point version, same patch level).

[/su_spoiler]

QUESTION 12

Which is the lowest Gateway version manageable by SmartCenter R77?
A. R65
B. S71
C. R55
D. R60A
[su_spoiler title=”Answer:” style=”default”] A

Explanation:

See the Compatibility Matrix for details on backwards compatibility.
[/su_spoiler]

QUESTION 13

Can you implement a complete IPv6 deployment without IPv4 addresses?

A. No. SmartCenter cannot be accessed from everywhere on the Internet.
B. Yes. Only one TCP stack (IPv6 or IPv4) can be used at the same time.
C. Yes, There is no requirement for managing IPv4 addresses.
D. No. IPv4 addresses are required for management.

[su_spoiler title=”Answer:” style=”default”] C

Explanation:

As the answer says, there is no requirement for IPv4 addresses. However, if you are migrating existing deployments then you may need to use a “dual stack”, “tunnelling” or “translation” – see this Checkpoint whitepaper for further details: IPv6 Public Whitepaper.

[/su_spoiler]

QUESTION 14

A ClusterXL configuration is limited to ___ members.
A. There is no limit.
B. 16
C. 6
D. 2
[su_spoiler title=”Answer:” style=”default”] C

Explanation:

Whilst C is the closest answer, it is not necessarily correct – from sk 83100:

The following are the maximum number of supported nodes in a cluster:

ClusterXL: 8 (According to page 6 in “ClusterXL Advanced Technical Reference Guide” – “Up to 8 cluster members are supported in ClusterXL”
IP Clustering on IPSO: 4
Third Party Clustering: 8
VSLS: 13

If full state synchronization is used in Security Gateway, the recommended maximum number of nodes is 4 regardless of the clustering mechanism used.

VSLS uses a more efficient state synchronization method and can safely support more than 4 nodes in a cluster.
[/su_spoiler]

QUESTION 15

Select the command set best used to verify proper failover function of a new ClusterXL configuration.

A. reboot
B. cphaprob -d failDevice -s problem -t 0 register / cphaprob -d failDevice unregister
C. clusterXL_admin down / clusterXL_admin up
D. cpstop/cpstart

[su_spoiler title=”Answer:” style=”default”] C

Explanation:

Page 62 of the R77 ClusterXL admin guide states:

Recommended method:
Run:
clusterXL_admin down
clusterXL_admin up
[/su_spoiler]

 

QUESTION 16

You are troubleshooting a HTTP connection problem. You’ve started fw monitor -o http.pcap. When you open http.pcap with Wireshark there is only one line. What is the most likely reason?

A. fw monitor was restricted to the wrong interface.
B. Like SmartView Tracker only the first packet of a connection will be captured by fw monitor.
C. By default only SYN packets are captured.
D. Acceleration was turned on and therefore fw monitor sees only SYN.

[su_spoiler title=”Answer:” style=”default”] D

Explanation:

If SecureXL is enabled on the Security Gateway, then ‘FW Monitor’ and ‘tcpdump’ will show only the non-accelerated packets (e.g., ‘TCP SYN’ will be shown, and ‘TCP ACK’ will not).

[/su_spoiler]

QUESTION 17

Which two processes are responsible on handling Identity Awareness?
A. pdp and lad
B. pdp and pdp-11
C. pep and lad
D. pdp and pep

[su_spoiler title=”Answer:” style=”default”] D

Explanation:

Referring to this article on processes and daemons:

pepd – Policy Enforcement Point daemon:

Receives identities via identity sharing
Redirects users to Captive Portal

pdpd – Policy Decision Point daemon

Acquires identities from identity sources
Shares identities with another gateways

[/su_spoiler]

QUESTION 18

Which three of the following are ClusterXL member requirements?

1) same operating systems
2) same Check Point version
3) same appliance model
4) same policy

A. 1, 3, and 4
B. 1, 2, and 4
C. 2, 3, and 4
D. 1, 2, and 3

[su_spoiler title=”Answer:” style=”default”] D

Explanation: Page 18 of R77 ClusterXL Admin Guide states that:

All cluster members must run on identically configured platforms
All cluster members must use the same Check Point software version
The policy is also installed to the cluster object, not individual firewall so they MUST have the same policy.

[/su_spoiler]

QUESTION 19

Fill in the blank. You can set Acceleration to ON or OFF using command syntax ___________ .

[su_spoiler title=”Answer:” style=”default”] fwaccel on / off [/su_spoiler]

QUESTION 20

You run cphaprob -a if. When you review the output, you find the word DOWN. What does DOWN mean?
A. The cluster link is down.
B. The physical interface is administratively set to DOWN.
C. The physical interface is down.
D. CCP pakets couldn’t be sent to or didn’t arrive from neighbor member.

[su_spoiler title=”Answer:” style=”default”] D

Explanation: From the CLusterXL Troubleshooting guide, “Down” means that one of the critical devices is down.

A “Down” category is assigned when a member does not receive any CCP packets from its neighbour.

[/su_spoiler]

QUESTION 21

Which three of the following components are required to get a SmartEvent up and running?

1) SmartEvent SIC
2) SmartEvent Correlation Unit
3) SmartEvent Server
4) SmartEvent Analyzer
5) SmartEvent Client

A. 2, 3, and 5
B. 1, 2, and 4
C. 1, 2, and 3
D. 3, 4, and 5

[su_spoiler title=”Answer:” style=”default”] A

Explanation: SmartEvent has several components that work together to help track down security threats and make your network more secure:

Correlation Unit that analyzes log entries on Log servers
SmartEvent server that contains the Events Database
SmartEvent client that manages SmartEvent

They work together in the following manner:

The Correlation Unit analyzes each log entry as it enters a Log server, looking for patterns according to the installed Event Policy. The logs contain data from both Check Point products and certain third-party devices. When a threat pattern is identified, the Correlation Unit forwards what is known as an event to the SmartEvent server.
When the SmartEvent server receives events from a Correlation Unit, it assigns a severity level to the event, invokes any defined automatic reactions, and adds the event to the Events Database that resides on the server. The severity level and automatic reaction are based on the Events Policy.
The SmartEvent client displays the received events, and is the place to manage events (such as filtering and closing events) and fine-tune and install the Events Policy.

[/su_spoiler]

QUESTION 22

MegaCorp is using SmartCenter Server with several gateways. Their requirements result in a heavy log load. Would it be feasible to add the SmartEvent Correlation Unit and SmartEvent Server to their SmartCenter Server?

A. No. SmartCenter SIC will interfere with the function of SmartEvent.
B. No. If SmartCenter is already under stress, the use of a separate server for SmartEvent is recommended.
C. No, SmartEvent and Smartcenter cannot be installed on the same machine at the same time.
D. Yes. SmartEvent must be installed on your SmartCenter Server.

[su_spoiler title=”Answer:” style=”default”] B

Explanation: The SmartEvent components can be installed on a single machine along with Smartcenter server but this will bring additional load – if the SCS is already under load then a separate machine for SmartEvent is recommended.

[/su_spoiler]

QUESTION 23

Fill in the blank. To verify that a VPN Tunnel is properly established, use the command _________

[su_spoiler title=”Answer:” style=”default”] vpn tunnelutil

Explanation: This can be shortened to “vpn tu”

[/su_spoiler]

QUESTION 24

MultiCorp is located in Atlanta. It has a branch office in Europe, Asia, and Africa. Each location has its own AD controller for local user login. How many ADqueries have to be configured?

[su_spoiler title=”Answer:” style=”default”] 4

Explanation: One query for each controller in Atlanta, Europe, Asia, and Africa.[/su_spoiler]

QUESTION 25

Fill in the blank. The command that typically generates the firewall application, operating system, and hardware specific drivers is _________ .

[su_spoiler title=”Answer:” style=”default”] snapshot

Explanation: The SecurePlatform Image and configuration can be saved and reverted with the snapshot and revert commands. These commands can be run in Standard and Expert Modes, and can use a TFTP or SCP server to store snapshots (locally, if necessary).
[/su_spoiler]

QUESTION 26

Fill in the blanks. To view the number of concurrent connections going through your firewall, you would use the command and syntax __ ___ __ __________ __ .

[su_spoiler title=”Answer:” style=”default”] fw tab -t connections -s

Explanation:

fw tab -t connections -s (for summary)
fw tab -t connections -x (to clear)
[/su_spoiler]

QUESTION 27

Fill in the blanks. To view the number of concurrent connections going through core 0 on the firewall, you would use the command and syntax __ __ _ ___ __ ___________ __ .

[su_spoiler title=”Answer:” style=”default”] fw -i 0 tab -t connections -s

Explanation: To see what connections are assigned to a particular core, use this command ‘fw -i tab -t connections’:
[Expert@HostName]# fw -i 0 tab -t connections
[Expert@HostName]# fw -i 0 tab -t connections -s
[/su_spoiler]

QUESTION 28

Which Check Point tool allows you to open a debug file and see the VPN packet exchange details.
A. PacketDebug.exe
B. VPNDebugger.exe
C. IkeView.exe
D. IPSECDebug.exe

[su_spoiler title=”Answer:” style=”default”] C

Explanation: C is the only viable answer as the other utilities do not exist.

[/su_spoiler]

QUESTION 29

When a packet is flowing through the security gateway, which one of the following is a valid inspection path?

A. Acceleration Path
B. Small Path
C. Firewall Path
D. Medium Path

[su_spoiler title=”Answer:” style=”default”] D

Explanation:

Slow path – Packets and connections that are inspected by the Firewall and are not processed by SecureXL.
Fast (Accelerated) path – Packets and connections that are offloaded to SecureXL and are not processed by the Firewall.
Medium path – Packets that require deeper inspection cannot use the accelerated path. It is not necessary for the Firewall to inspect these packets, they can be offloaded and do not use the slow path. For example, packets that are inspected by IPS cannot use the accelerated path and can be offloaded to the IPS PSL (Passive Streaming Library). SecureXL processes these packets more quickly than packets on the slow path.
[/su_spoiler]

QUESTION 30

To run GAiA in 64bit mode, which of the following is true?

1) Run set edition default 64-bit.
2) Install more than 4 GB RAM.
3) Install more than 4 TB of Hard Disk.

A. 1 and 3
B. 1 and 2
C. 2 and 3
D. 1, 2, and 3

[su_spoiler title=”Answer:” style=”default”] B

Explanation:

You are required to run the set edition command and have more than 4GB RAM but HDD size has no impact.
[/su_spoiler]