R75 UFP causes high CPU usage

Be Careful when upgrading R65 to R75
There is a hotfix for UFP Opsec Connection, request it from support before going in to Production..
Symptomps are,
CPU Peak %100 , ping latency , drop packets..
How to replicate,
Try high size downloads..

SmartSPLAT v5 Redesigned from your feedbacks..

    New Telnet Option,
    New Right Click Menu,
    New SSH Port definition,
    New Duplicate SSH Option,
    New Health Check Option,
    New Cluster Terminal,

    and more...

    http://www.smartsplat.com/

How to reset SmartEvent database, Cause:Error at Reports

1. Run evstop to stop the reporter module.
2. Delete all files in the \var\$RTDIR\Database\log directory.
3. Delete all files in the \var\$RTDIR\Database\data directory
4. Extract the contents of $RTDIR\conf\db_files.tgz to \var\$RTDIR\Database\data directory.
5. Run evstart to start the reporter module.

This process will completely overwrite the existing database files with clean new ones.

Manual NAT not working!

2 Things to know about Manual NAT and ARP

on the upstream router you have to route the external NAT address or address range to the external interface address of the firewall,if its cluster then add routes to vip ip

If you can't manage the router then you have to add the nat ip and mac addresses of related ext interface described at sk30197

SmartSPLAT v4.2 is Released

New VSX and Provider-1 commands are added to this release, Enjoy it.

http://www.smartsplat.com/ 

Checkpoint and Multicast Traffic

In order to allow multicast traffic by the gateway, you need to follow sk35996, In addition you also need to create an allow rule with the service “pim”.

Regarding sk31190 Secure platform pro needs to be enabled if you would like the gateway to participate in the multicasting traffic.

If you just want to let that traffic pass through the gateway and the gateway does not need to perform any dynamic routing decisions then there is no need to enable Splat Pro.

Some tips,
# tcpdump ip multicast  will show you multicast packets..

to enable Secure Platform Router Config mode type “pro enable”
This will need a license of “Advanced Routing Blade”
Lets enable multicast routing with sparse mode

[Expert@NGx-gw1]# router config
localhost.localdomain>enable
localhost.localdomain#config t
localhost.localdomain(config)#interface eth0
localhost.localdomain(config-if)#ip pim sparse-mode
localhost.localdomain(config-if)#exit
localhost.localdomain(config)#interface eth1
localhost.localdomain(config-if)#ip pim sparse-mode
localhost.localdomain(config-if)#exit
localhost.localdomain(config)#ip pim enable
localhost.localdomain(config)#exit
localhost.localdomain#wr mem

Cluster Status Active - Ready

Last night I have faced a problem after replacing cluster nodes to new hardwares,
Although software versions was same at # cphaprob stat command, One node was at active and other was at ready
Solution is at CoreXL: Noticed that enabled cores differs on nodes, #  fw ctl multik stat shows this to you.
number of cores should be same at both members.

R75.20 Console Error

If you are getting the below error at SmartConsole,
Failed to save object firewall_properties.
Server error is:Validation error in field 'SynDefender active mode' at
object 'firewall_properties' @ 'properties' --> The value '0' is not in the list of valid values '1~2'. (Code: 0x800415A6, Object Validation Failed)

Create an upgrade_export then Close all SmartConsoles and open GuiDBedit.exe located at SmartConsole directory X:\Program Files\CheckPoint\SmartConsole\R7X\PROGRAM
Find the related object via CTRL+F,In this example its firewall_properties, Change the value of the property (1) and click saveall, If it gives a similar error continue to fix it with needed parameter.

Mobile Access VPN Policy tab is Empty

An exception occured while constructing the view:
CDIeException Exception:
Error Code: 0(Unspecified error)
User Message: Genera Error: Invalid or No UID
Debug Message:
CDleDereferenceReqHandler::_dereferenceSingleFieldObject not found in CPMI
File Name:
f:\ckp\src\cpdle_flow_983000029\cpdle\comm_itf\CommandCpmiAsync.h
Line number: 207
Inner: NONE

Solution:
Backup and delete the files
applications.C
CPMILinksMGR.db
at $FWDIR/conf
This is a general solution for SmartConsole problems..

Updated Note: Checkout connectra_policy.C File , correct the corrupted lines.

Changing Mac Magic numbers at Checkpoint Cluster

Below operation should be done at the scenario where two checkpoint clusters work on the same network.
To view the values
# fw ctl get int fwha_mac_magic
# fw ctl get int fwha_mac_forward_magic
default values are 254 and 253
Lets change them to 251 and 250
# fw ctl set int fwha_mac_magic 251
# fw ctl set int fwha_mac_forward_magic 250
Also we should write these to $FWDIR/boot/modules/fwkern.conf with hex values like the example below
fwha_mac_magic=0xfb
fwha_mac_forward_magic=0xfa