NSS Solutions

I found myself needing these clish commands yestday. Since the Nokia Knowledge base has been migrated over to the Check Point knowledge base I can’t find anything anymore.

Nokia CLISH commands
—setting default gateway
set static-route default nexthop gateway address 192.168.29.2 priority 1 on—adding static routes
set static-route 172.23.124.150/32 nexthop gateway address 192.168.29.50 on

—Add proxy arp
add arpproxy address 192.168.29.56 macaddress 0:a0:8e:7d:13:d0
add arpproxy address 192.168.29.57 macaddress 0:a0:8e:7d:13:d0

—Add an interface
set interface eth1 speed 100M duplex full active on
add interface eth1c0 address 192.168.29.54/24 enable

—VRRP

set vrrp accept-connections on
set vrrp coldstart-delay 60

set vrrp interface eth1c0 monitored-circuit vrid 54 monitored-interface eth2c0 on
set vrrp interface eth1c0 monitored-circuit vrid 54 monitored-interface eth2c0 priority-delta 10
set vrrp interface eth1c0 monitored-circuit vrid 54 monitored-interface eth3c0 on
set vrrp interface eth1c0 monitored-circuit vrid 54 monitored-interface eth3c0 priority-delta 10
set vrrp interface eth1c0 monitored-circuit vrid 54 priority 100
set vrrp interface eth1c0 monitored-circuit vrid 54 hello-interval 1
set vrrp interface eth1c0 monitored-circuit vrid 54 vmac-mode default-vmac
set vrrp interface eth1c0 monitored-circuit vrid 54 backup-address 192.168.29.1 on

—Set ntp servers

add ntp server 10.1.1.2 version 3 prefer yes
add ntp server 10.1.1.1 version 3 prefer yes

—Setting Time zone

set date timezone-city “Greenwich (GMT)”

—Add hostname

set hostname testbox

—Add Host address assignments

add host name testbox ipv4 192.168.29.54

From the command line you can view the aggregate throughput on the Nokia device. The example below will refresh every 5 seconds.

host[admin]#netstat 5

input (Total) output
packets errs bytes packets errs bytes colls
266 0 22455 181 0 17460 0
266 0 21419 169 0 14380 0
264 0 20831 172 0 15385 0

1. Setup a FW-1 kernel debug buffer to store the FW-1 console messages

1. fw ctl debug -buf 8192

2. Next flush the debug buffer (setup in step 1) to syslog

1. fw ctl kdebug -f | logger &

3. To make this persistent across reboots add the above commands to the rc.local

Enable SecureXL, to do this

1. SSH into the firewall
2. Run the command cpconfig
3. There will be an option to Enable Check Point SecureXL, enable it

SmartDefense settings that will impact SecureXL:

· SYN Attack Configuration – Disables Templates

· Network Quota – Disables Templates

· ISN Spoofing – Disable Acceleration.

· Spoofed Reset protection – Forwards RST packets to the Firewall

· Sequence Verifier – Make sure to turn on “Sequence Validation” in “Advanced System Tuning” page in Voyager.

· TTL Check – Disable Acceleration

· IP ID Check – Disable Acceleration

· Application Intelligence Check:

o POP3/IMAP Security – Disables Acceleration

o Mail Server Security – Disable Acceleration

o FTP Security Server – Disable Acceleration

o Microsoft Networks – File and Print sharing – Disables Acceleration

o Block NULL CIFS sessions – Disable Acceleration

o Block Popup Messages – Disable Acceleration for Microsoft networks

o Block ASN.1 – Disables Acceleration for relevant protocols

o Block WINS Replication attack – Disables Acceleration for MS WINS traffic

o Block WINS Name Violation – Disables Acceleration for WINS traffic

o Peer-to-Peer: Disables Templates

o Instant M’essanger: Disables Template

o DNS Protection – Disables DNS Acceleration -TCP/UDP

o VoIP – Not Accelerated.

o SNMP Checks – Disables SNMP traffic Acceleration

o SUN-RPC Program Lookup – Disable Acceleration for SUN-RPC Traffic only

o VPN Protocols:

o PPTP Enforcement – Disables Acceleration of PPTP traffic

o SSL enforcement – Disables Acceleration of SSL traffic

o Block IKE Aggressive Exchange – Disables IKE Acceleration for client to server direction only

o IKE enforcement – Disables IKE Acceleration for client to server direction only

o SSH – Detect SSH over non-standard port – Disables Templates on ALL traffic

o SSH enforcement – Disables Acceleration for ssh traffic

o Content Protection:

o Malformed JPEG – Disables Acceleration for all HTTP

o Malformed ANI files – Disables Acceleration for all HTTP

o MS-RPC – Disable Acceleration for RPC traffic

o MS-SQL – Disable Acceleration for MS-SQL traffic

o Routing Protocols Check: Disable Acceleration for these protocols only (RIP,BGP,OSPF,IGMP)

o Application Layer: Web Intelligence :

o HTTP Header Spoofing Check – Disables Acceleration on all HTTP traffic

o Directory Listing – Disables Acceleration on all HTTP traffic

o Error Concealment – Disables Acceleration on all HTTP traffic

o ASCII only response header – Disables Acceleration on all HTTP traffic

o Block HTTP on non-standard port – Disables Template

o Block HTTP Malicious Encodings – Disables Templates

I have also attached the SmartDefense User Guide.

Disable unnecessary services

In the $FWDIR/conf/fwauthd.conf comment out the following lines

80 fwssd in.ahttpd wait -4
25 fwssd in.asmtpd wait 0
2525 fwssd in.emaild.smtp wait 0
110 fwssd in.emaild.pop3 wait 0
10081 fwssd in.lhttpd wait 0
900 fwssd in.ahclientd wait 900
0 fwssd in.asessiond respawn 0
0 fwssd in.aufpd respawn 0
0 stormd stormd respawn 0
0 sds sdsd respawn 0
0 dtps dtpsd respawn 0
0 dtls dtlsd respawn 0

Upgrade RAM

With the 1 Gig of RAM that you currently have the Checkpoint Max connections would be 225000. I would high recommend you upgrade to the 2 Gig’s of RAM that will allow that 725000 connections. I have included the Nokia documentation below that talks about the memory utilization on flash firewalls and the amount of memory that a connection will use.

Table 2 Flash-Based IP security Platforms:

DRAM CP Max Conns CP Max Conns with Web Intelligence Hash Table size Memory Pool size Max Memory Pool size
512 MB * 90,000 39,000 4 MB 128 MB 196 MB
1 GB 225,000 112,000 8 MB 256 MB 400 MB
2 GB 725,000 304,000 16 MB 800 MB 900 MB
Note: (*) 512MB PCMCIA card required on the IP265 in order to achieve the number (39,000) above.

In case you need to customize these settings, use the following data to determine the exact value as per your need:

Memory Requirements for FireWall-1 NG/NGX

The memory required depends on the kind of connections used:

o For simple connections (accept), overhead_per_connection is ~325 bytes

o For NAT’ed connections: overhead_per_connection is ~542 bytes

o For Resources: overhead_per_connection is ~401 bytes

o For VPN: overhead_per connection is ~399 bytes

o For general overhead: 6mb

Assuming the worst case scenario (NAT):
fwhmem = 6mb + 542 * connections_limit

For 100000 connections it is:
6144*1024 + 542*100000 = 60491456 (57.6 MB)

Keep in mind that FireWall-1 doesn’t actually release the memory used for a TCP connection until about a minute after the connection ends. You should take this into account when planning how many connections you expect to handle.
Write Console Messages to Messages file

The last suggestion at this time is to log the console messages to the messages file. This will increase the CPU and it will not have to wait for Checkpoint to write to the console before it can process the next request. I have included the directions below.

1. Setup a FW-1 kernel debug buffer to store the FW-1 console messages
# fw ctl debug -buf 8192

2. Next flush the debug buffer (setup in step 1) to syslog
# fw ctl kdebug -f | logger &

3. To make this persistent across reboots add the above commands to the rc.local