Export Check Point by hand
Gaia OS settings from clish, or one policy package from the Show Package Tool.
Gaia gateway
In clish, run this and save the output as one .txt file:
set clienv rows 0
show configurationIt is read for the gateway's own OS settings: interfaces, routes, DNS, NTP, SNMP, local users, who may open SSH or the WebUI, and password rules. It holds no policy, and the analysis says so.
Security Management policy
Upload the .tar.gz the Check Point Show Package Tool writes. It holds one policy package: its layers are read, with no gateways, administrators or global properties.
A package is not a firewall. Analyze its gateway first, then upload the package again and choose that gateway.
Through the Relay
| Reading | Command or source |
|---|---|
| Gateway OS (SSH) | show configuration |
| Gateway version, HA and licenses (SSH) | fw ver, cphaprob state, cplic print |
| Gateway OS (Gaia API) | show-hostname, show-version, show-interfaces, show-static-routes and the other Gaia API reads |
| Routing table | show route, show ipv6 route |
| LLDP neighbors | lldpneighbors over SSH, show-lldp over the Gaia API |
| Management policy with its gateways | The Management API of a Security Management Server, Multi-Domain Server or Smart-1 Cloud |
A Gaia show configuration upload does not carry the fw ver, cphaprob state or cplic print output. The Relay's bundle layout can also be assembled by hand from Management API answers; this guide does not cover it.
Upload
Open New analysis
Choose File upload and select the file, or choose Paste, paste the output and select Upload and parse.
It is sent at once
One file per upload. ConfigProof reads the vendor and export type from the content, not the file name, then asks the client, project and name. If your role is limited to certain clients, choose the client first.
Answer the picker if asked
A file that holds several VDOMs, contexts, virtual systems or gateways opens a picker. Each one you choose is its own analysis.
Operational CLI commands
show route
show ipv6 route
show bgp peers
show ospf neighbors
show interfaces allFor NAT and access rules, import the policy package from Security Management. The Gaia configuration covers the gateway OS.
fw ver
fw stat
cphaprob state
cphaprob -a if
cplic printReport evidence and rule hit counts
Check Point gateway. Available sources across collection methods
Enable gateway hit reporting, then collect access hits from Security Management.
Hit counters without a supported source: access, nat, https inspection, threat prevention.
- Supported checks
- Active routes, Route decisions, HA state, Remote access, Lifecycle dates, Configuration history, Rule dependencies
- Checks not yet supported
- CDP / LLDP, Tunnel, BGP and interface state, VPN and NAT, Recommended release, Change attribution, Pending changes, Reachability
Check Point SMS / MDS / Smart-1 Cloud
Check Point SMS / MDS / Smart-1 Cloud. Available sources across collection methods
- access
- Relay, API: Last hit, Counting window unavailable.
- Relay: Last hit, Counting window unavailable.
- Supported file export: Last hit, Counting window unavailable.
Hit counters without a supported source: nat, https inspection, threat prevention.
Without a counting window, zero hits cannot prove a rule is unused.
- Supported checks
- Lifecycle dates, Configuration history, Rule dependencies
- Checks not yet supported
- HA state, VPN and NAT, Recommended release, Change attribution, Pending changes
- Outside this device’s role
- Active routes, Route decisions, CDP / LLDP, Tunnel, BGP and interface state, Remote access, Reachability