Iphone IPad support for Connectra

Connectra (All versions for now 23.05.2011) does not support Checkpoint Mobile Vpn Software , you cant use the Vpn client because certificate enrollment is not supported you will get an error "Certificate Enrollment Failed" You have to upgrade to Mobile Access Blade.

You only can use safari browser but if you are using ICS then again you wont be able to login to Portal.

Deployment shell internal error at Connectra

To successfully use Connectra Portal ICS (Scanning with compliance policy ) activeX and Java VM should be installed on the pc, If the two components are successfully installed another component deployment shell installation begins , if you have a problem with the two prequiste you cant install the deployment shell and you get the warning deployment shell internal error.
Solution: unregister the pc from windows domain (you wont deal with GPO,User Profiles,Security Templates , etc. ) unistall everything and do a fresh install.

Also, ICS components reside at /opt/CPcvpn-R66/htdocs/ICS/components for R66.1 server ,replace them by the new files from your test vm
and apply the command # cvpn_port_utility.csh.R66_01

Also checkout http://www.microsoft.com/technet/security/advisory/2562937.mspx

use "wusa /uninstall /kb:2562937"    command to uninstall the related update.

SmartSPLAT v4 is now Released

    I'm pleased to announce the release of SmartSPLAT v4

This version includes a number of new features,

New Floaty Terminals,
New Floaty HTML Notepad with browser support,
New Recording options, You can now record everything within Shells,
New SCP support you can upload and download files via browsing, (Integrated with Putty PSCP)
New Tufin Terminal Support
New Nokia Terminal Support
New HyperTerminal support for Win7
New External software support , you can now open debug outputs via WordPad or Wireshark,
New Confirmation dialogs and tooltips on commands
New Syslog Server supports Windows 7 and Server 2008

Basic way to test an IPS via Windows CLI

Telnet to a webserver behind the IPS and execute the command,

GET ../../etc/passwd HTTP/1.0      



Yo will see the HTTP_GET_Malformed signature triggered at SiteProtector

Also you can use this technique at pentests, it gives you to discover if there is an IPS or not.

Open a WireShark and examine the return packets, if you see RST packets or connection time-outs you can be sure that the IPS is active.

Steps are simple, Can be used for any IPS vendor.

Cagdas Ulucan



Checkpoint Reverse Proxy Configuration

Checkpoint Reverse Proxy listens requests from the Internet and forwars them to inside web servers, request connects to the proxy and may not be aware of the internal network.
This can be used for loadbalancing , publishing OCS and etc.

We need 2 rules for this,

Source: Any
Destination: http://www.test.com/
Service: HTTP -> test
Action: drop

Source: Any
Destination: internalipaddress

Service: HTTP
Action: Accept

URI Resource should be like this;

Difference between Install Policy and Install Database

In Some situations Ex: log server, Mail Alert settings and etc. related to SMC should be done with install database, Policy install doesnt include specific Install Database operations.

Always Keep in mind this not to waste your time.

magic number corrupted fwauth.NDB

Cant install policy to one of the cluster member,warning message : magic number corrupted

Copy the fwauth.NDB from  $FWDIR/conf/defaultDatabase  to $FWDIR/conf/database , reinstall policy.

Corruption in the Checkpoint IPS database

IPS reset procedure

1. Delete all IPS profiles except the default profiles (Default_Protection and Recommended_Protection).
2. Prepare the clean IPS files that are listed below from the same version
3. # cpstop
4. # cd $FWDIR/conf
5. Copy the provided IPS files to conf directory:
$FWDIR/conf/
inspect_logs.C
ips_db_cfg.C
sd_parser_settings.C
inspect_logs_profiles.C
ips_exceptions_table.C
sd_topic_categories.C
asm.C
inspect_streaming.C
ips_protections_override_table.C
sd_topics.C
asm_profiles.C
ips_attribute_extensions.C
ips_protections_per_profile_table.C
sd_topics.conversion
ips_attribute_extensions.C.converted
ips_signatures.C
sd_topics_table.C
default_asm.C
ips_c_s.C
ips_signatures.C.converted
inspect.C
ips_classes.C
ips_tables.sqlite
inspect.lf
ips_contexts.C
profiles.C
6. Edit the file $FWDIR/conf/asm.C, change:
need_local_update to "true"
asm_update_version_ips1 to "0"
asm_update_version_vpn1 to "0"
asm_update_version to "0"
7. Delete $FWDIR/conf/CPMILinks* and $FWDIR/conf/applications.C
8. Delete $FWDIR/conf/SMC_Files/asm/crc_marker_db.fws
9. # cpstart
10. fwm should start a process called "sduu", wait until it finish, it can take several minutes.
11. Verify that :asm_update_version_ips1, :asm_update_version_vpn1 and :asm_update_version value has changed and it's not zero now - means the silent update finished successfully.
12. Performed online update.
13. Push policy

/bin/console_age at hyper terminal

Today i had a problem with new Smart-1 appliance that comes with R71.10 image.
If HyperTerminal output stops responding at /bin/console_age
Dont directly think of RMA.
In my case This was a cable error.
The default cable that comes within device or a Standard cisco cable wont work. try an other RS232 connector, I tried a Proventia IPS cable and resolved the problem with it.

Also,
you may safety ignore the  "microcode device /dev/cpu/0/microcode doesn't exist" warnings that appears at console.



Checkpoint site-to-site vpn with Overlapping VPN domain

If two side in a site-to-site vpn has the same ip subnet, then we have to make a scenario similar to below,

Site A and Site B is using the 192.168.0.0/24 subnet,

Site A                                       Site B
LAN_A 192.168.0.0/24               LAN_B 192.168.0.0/24
we will nat to 172.16.0.0/24         and we will nat to 10.0.0.0/24


Site A VPN Domain = LAN_A and NAT_Net A
fw object that represents the Site B vpn domain = NAT_NETB_10.0.0.0

    Add the static nat at Site A

Site B VPN Domain = LAN_B and NAT_Net B
fw object that represents the Site A vpn domain = NAT_NETA_172.16.0.0

    Add the static nat at Site B