How-To

Tech Short: Capturing packets on Checkpoint

I’ve recently found myself capturing network traffic to troubleshoot reported issues. To successfully capture packets the use of tcpdump is required.  And while you may be familiar with using this tool, the use is slightly different on Checkpoint devices.

The devices in this reference is Checkpoint R77.30 and R80 devices.

To capture the correct network packets you must first disable Checkpoints SecureXL feature which is an acceleration solution that maximizes network performance of the Firewall.

To disable SecureXL, run the command:

fwaccel off

To check the overall SecureXL status:

fwaccel stat

Now that SecureXL has been disabled, continue to the capture steps below:

To capture packets, issue the following command:

tcpdump -s 0 -nni <interface_name> -w capture_file_name.pcap

Press Control-C (Ctrl C) to break the capture

Re-enable SecureXL, by running the following command:

fwaccel on

Retrieve the capture file and review using a tool such a Wireshark

Tech Short: Debug VPN in Checkpoint R77.30

The following tech short will provide a list of commands used to enable debugging in Checkpoint’s R77.30 Firewall. To start you must  SSH into firewall host (or active member).

To turn on VPN debug from the expert mode:

# vpn debug trunc

At this point you want to test your VPN connection and verify that IKE Phases. This can be done with the following commands:

# vpn tu (option 1 and 2), you may need to reset tunnel to test. This is done by using (option 7)

To tune off the VPN debug the following commands should be issued:

# vpn debug off

# vpn debug ike off

 

When completed retrieve the logs vpnd.elg and ike.elg – located under $FWDIR/log

Checkpoint has an IKEView tool which is located on their site, and used to review the logs, else using a tool such as Notepad++ for analysis is helpful.

OpenVPN Access Server on Ubuntu

I recently retired my OpenVPN Turnkey appliance and needed to get my VPN solution up and running again. I decided to go with installing OpenVPN Access Server on a clean install of Ubuntu Server to create a stable and light weight Virtual Private Network (VPN) to access my network.

I chose to go with OpenVPN AS because its using the OpenVPN I know and trust, but it also has the value added feature of an administrative server used for user and access management.

Setup is straight forward after a few small prerequisites are established.

Requirements:

  • Ubuntu Server – Running the latest version and updates. I am using 16.04.2-as my base
  • Root or possibly sudo access

Software:

Download the latest release of the OpenVPN AS Server
https://openvpn.net/index.php/access-server/download-openvpn-as-sw.html

The direct Ubuntu installs here

 

The following steps can be used to download and install:

  1. Download the install package: wget http://swupdate.openvpn.org/as/openvpn-as-2.1.9-Ubuntu16.amd_64.deb
  2. Install the downloaded package: dpkg -i openvpn-as-2.1.9-Ubuntu16.amd_64.deb
  3. Change the password for the openvpn user: passwd openvpn

When the installation has completed, the Access Server web UIs will be available here:
Admin UI: https://<yourip>:943/admin
Client UI: https://<yourip>:943/

 

And just like that you now can take better control over your privacy, security.

Note: I did not go over the configuration of OpenVPN AS, I may do this in another post. I just wanted to run though the steps of getting this software installed.

Disabling SMB1.0/CIFS File Sharing Support

There is a lot of buzz these days about new ransomware hijacking systems worldwide. The malware, dubbed NotPetya because it masquerades as the Petya ransomware. One of the many ways to help the spread of malware is to patch your computer, effectively stopping the SMB exploits by disabling SMBv1.

Here are steps which can be used to disable (remove) SMBv1 support.

For client operating systems:

  1. Open Control Panel, click Programs, and then click Turn Windows features on or off.
  2. In the Windows Features window, clear the SMB1.0/CIFS File Sharing Support checkbox, and then click OK to close the window.
  3. Restart

For server operating systems:

  1. Open Server Manager and then click the Manage menu and select Remove Roles and Features.
  2. In the Features window, clear the SMB1.0/CIFS File Sharing Support check box, and then click OK to close the window.
  3. Restart

Ref: https://support.microsoft.com/en-us/help/2696547/how-to-enable-and-disable-smbv1-smbv2-and-smbv3-in-windows-and-windows

Server 2008 R2, ‘Powershell’ is not recognized as an internal or external command …

While working on a task scheduling a powershell script, it was noticed that the powershell command does not execute from the command prompt on a server. When run I would encounter the following error: ‘powersehll’ is not recognized as an internal or external command, operable program or batch file.

After searching around Google / Bing I gave up and made the following attempt which worked out for myself and the system owners.

Looking at the system PATH variable seems correct with the expected path variable included under system variables: %SYSTEMROOT%\System32\WindowsPowerShell\v1.0\

I decided to check with my user only: I added ‘%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\’ to my user variable with success

In the systems path variables and removed the reference and added it to the end of the line which was successful in resolving the system wide issue.

Notes: This is a snapshot of before and after changes introduced which resolved my issue

original:
%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\Microsoft SQL Server\100\Tools\Binn\;C:\Program Files\Microsoft SQL Server\100\Tools\Binn\;C:\Program Files\Microsoft SQL Server\100\DTS\Binn\;C:\Program Files (x86)\Microsoft SQL Server\100\Tools\Binn\VSShell\Common7\IDE\;C:\Program Files (x86)\Microsoft Visual Studio 9.0\Common7\IDE\PrivateAssemblies\;C:\Program Files (x86)\Microsoft SQL Server\100\DTS\Binn\

updated:
%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files (x86)\Microsoft SQL Server\100\Tools\Binn\;C:\Program Files\Microsoft SQL Server\100\Tools\Binn\;C:\Program Files\Microsoft SQL Server\100\DTS\Binn\;C:\Program Files (x86)\Microsoft SQL Server\100\Tools\Binn\VSShell\Common7\IDE\;C:\Program Files (x86)\Microsoft Visual Studio 9.0\Common7\IDE\PrivateAssemblies\;C:\Program Files (x86)\Microsoft SQL Server\100\DTS\Binn\;%SYSTEMROOT%\System32\WindowsPowerShell\v1.0\

Cause of issue is still unknown.  Perhaps an ordering issues in the variables.  If you know please feel free to comment.
Thanks,

Jermal