Information Security Notes: November 2012

Monday, November 26, 2012

Smart Uploader (GUI for cp_uploader.exe)

As you know CheckPoint released a new upload tool called Check Point Uploader utility ( sk84000 )
This tool enables you to upload the files securely to Check Point using your user center credentials.

I have developed a GUI for cp_uploader.exe
Enjoy it!

Click to download Smart Uploader

Wednesday, November 14, 2012

How to Enable SNMP on Checkpoint

# snmp service disable
# snmp service enable
# snmp user show
You should delete the community named public
# snmp user del public
# snmp user add noauthuser CommunityName

# snmp service stat
You should see
SNMP service enabled and listening on port 161.
enable snmp extensions
# cp_conf snmp get
Currently SNMP Extension is active
# cp_conf snmp activate
Check the ports, both 260 and 161 should be listening..

Lets do some SNMP Walk
Total RAM on System
# snmpwalk -v1 -c CommunityName firewallipaddress .1.3.6.1.4.1.2021.4.5.0
do a fw tab -t connections -s and count connections
# snmpwalk -v1 -c testcom 192.168.1.112 .1.3.6.1.4.1.2620.1.1.25.3.0

Snmp version should be 5.3.1.0-2
checkout with the command #rpm –qa | grep net-snmp
Some Checkpoint SNMP OIDS
CPU Usage .1.3.6.1.4.1.2620.1.6.7.2.4.0
CPU System .1.3.6.1.4.1.2620.1.6.7.2.2.0
CPU User .1.3.6.1.4.1.2620.1.6.7.2.1.0
Number of Connections .1.3.6.1.4.1.2620.1.1.25.3.0
Peak Number of Connections .1.3.6.1.4.1.2620.1.1.25.4.0
Memory Total .1.3.6.1.4.1.2620.1.6.7.4.3.0
Memory Used .1.3.6.1.4.1.2620.1.6.7.4.4.0
Memory Free 1.3.6.1.4.1.2620.1.6.7.1.5.0
Memory Buffered .1.3.6.1.4.1.2021.4.14.0
Memory cached .1.3.6.1.4.1.2021.4.15.0
Swap error .1.3.6.1.4.1.2021.4.100.0
CPU FAN Speed 1.3.6.1.4.1.2620.1.6.7.8.2.1.3.1.0
Chassis FAN Speed 1.3.6.1.4.1.2620.1.6.7.8.2.1.3.2.0
Core Voltage 1.3.6.1.4.1.2620.1.6.7.8.3.1.3.1.0
VCC+Voltage 1.3.6.1.4.1.2620.1.6.7.8.3.1.3.2.0
1.8 Voltage 1.3.6.1.4.1.2620.1.6.7.8.3.1.3.3.0
5V Power Supply In 1.3.6.1.4.1.2620.1.6.7.8.3.1.3.4.0
5V Standby Voltage 1.3.6.1.4.1.2620.1.6.7.8.3.1.3.5.0
Battery Voltage 1.3.6.1.4.1.2620.1.6.7.8.3.1.3.6.0
CPU temperature 1.3.6.1.4.1.2620.1.6.7.8.1.1.3.1.0
M/B Temperature 1.3.6.1.4.1.2620.1.6.7.8.1.1.3.2.0

DDoS Seminar in Ankara

Last friday Checkpoint and InfoNet have prepared a DDoS seminar in Ankara,

I had created a lab similar to http://www.youtube.com/watch?v=5rhw7zsiarQ&feature=plcp that I have posted earlier.

The lab had 2 phases, with DDoS protector and without it which the attacker directly faces to firewall, We have investigated and compared both behaviours..

After showing some attack vectors the main subject was to try to explain the reason of why we need a DDoS mitigation device other than getting this as a service from ISP and explained why its a network design problem and how to deal with it on every hop count