Check Point 600 Appliance Software Blade Stuck in Updating status

Recently I had a chance to get my hands on this excellent Firewall by Checkpoint. And as you know not everything goes perfectly, and this is where you get a chance to learn how it works, while you fix.

I encountered an issue where one of the Threat Prevention Blades was stuck in updating mode for several hours. I had logged into the appliance via SSH to view to CPU utilization and observed nothing which would indicate an issue.

I started thinking about what events occurred which may have caused this. So I looked at the auto update schedule for the blades and noticed that all 3 blades where set to upgrade simultaneously.

I have observed that these updated can causes very high consumption of CPU and which that perhaps the blade with the issue became stuck in an upgrading status.

To address this situation, I issued the update command from the CLI :

  1. Log into the firewall via SSH
  2. Enter into expert mode by typing ‘expert’ in the CLI – You will be asked for your expert password. Once in export you will be in a standard Linux bash prompt.
  3. Run the following while in expert mode depending on which update you require:
  • Anti-Virus Blade: []# online_update_cmd -b AV -o update
  • IPS Blade: []# online_update_cmd -b IPS -o update
  • Application Control Blade: []# online_update_cmd -b APPI -o update


Now return and refresh your webUI and you should notice that the blade(s) that were once stuck in the upgrading status are now showing up to date.

Check Point 600 Appliance Initial Setup

The following is a quick video of the setup of a Checkpoint 600 Security Appliance

Notes right from the admin guide:

Check Point 600 Appliance Overview
Check Point 600 Appliance delivers integrated unified threat management to protect your organization from
today’s emerging threats. Based on proven Check Point security technologies such as Stateful Inspection,
Application Intelligence, and SMART (Security Management Architecture), Check Point 600 Appliance
provides simplified deployment while delivering uncompromising levels of security.


Check Point 600 Appliance supports the Check Point Software Blade architecture that gives independent
and modular security building blocks. Software Blades can be quickly enabled and configured into your
solution based on specific security needs.


This video takes place, right after the Check Point 600 was connected to WAN, LAN, and Powered Up.

Linux Commands, And More Commands

I have posted about commands in the past. I am now ‘rebooting’ that post adding additional commands that I find useful.

File Transfer:

$ scp somefile.txt server:/tmp Secure copies somefile.txt to remote host /tmp folder

$ scp sysadmin@server:/www/*.html /www/tmp Copies *.html files from remote host to current system /www/tmp folder

$ scp -r sysadmin@server:/www /www/tmp Copies all files and folders recursively from remote server to the current system /www/tmp folder

$ rsync -a /home/backup /backup/ Synchronizes source to destination


File and Folder Archive:

$ tar cf home.tar home Creates tar named home.tar containing home/

$ tar xf file.tar Extracts the files from file.tar

$ tar czf file.tar.gz files Creates a tar with gzip compression

$ gzip file Compresses the file and renames it to file.gz


Networking Stuff:

$ ifconfig -a Display all network ports and ip address

$ ifconfig eth0 Display specific ethernet port ip address and details

$ ip addr show Display all network interfaces and ip address(available in iproute2 package,powerful than ifconfig)

$ ip address add dev eth0 Set ip address

$ ethtool eth0 Linux tool to show ethernet status

$ mii-tool eth0 Linux tool to show ethernet status

$ ping host Sends echo request to test connection

$ whois domain Get who is information for domain

$ dig domain Get DNS information for domain

$ dig -x host Reverse lookup host

$ host Lookup DNS ip address for the name

$ hostname -i Lookup local ip address

$ wget file Download file

$ netstat -tupl Listing all active listening ports(tcp,udp,pid)

$ ssh user@host Connects to host as user

$ ssh -p port user@host Connects to host using specific port

$ telnet host Connects to the system using telnet port



$ chmod 777 /data/test.c Sets rwx permission for owner , rwx permission for group, rwx permission for world

$ chmod 755 /data/test.c Sets rwx permission for owner,rx for group and world

$ chown owner-user file Changes the owner of the file

$ chown owner-user:owner-group file-name Changes the owner and group owner of the file

$ chown owner-user:owner-group directory Changes the owner and group owner of the directory


Process Management:

$ ps Displays your currently active processes

$ ps aux | grep ‘telnet’ Finds all process id related to telnet process

$ pmap Memory map of process

$ top Display all running processes

$ kill pid Kill process with mentioned pid id

$ killall proc Kill all processes named proc

$ sleep 10 & Sleeps at the background

$ kill ‘JobNumber ‘ Terminates the job

$ jobs Display the jobs

$ pkill processname Send signal to a process with its name

$ bg Resumes suspended jobs without bringing them to foreground

$ fg Brings the most recent job to foreground

$ fg n Brings job n to the foreground


Useful File Commands:

$ cd .. To go up one level of the directory tree

$ cd Goes to $HOME directory

$ cd /test Changes to /test directory

$ ls gives the contents of a folder.

$ ls -a gives all the contents of a folder.

$ mkdir FolderName creates the folder FolderName.

$ cd Directory makes the Directory current directory

$ pwd prints the working directory

$ cp ~/Desktop/Berk/backups/science.txt . copy science.txt to the current directory

$ mv backups/science.txt /Desktop/Emi moves science.txt to folder Emi

$ rm temp.txt removes the temp.txt file

$ clear clear screen

$ cat science.txt Display contents of a file on the screen

$ less science.txt Displays on a different page ( type q to close the page)

$ less science.txt and then /name finds the occurences of name

$ head science.txt displays the first ten lines of the file

$ tail science.txt displays the last ten lines of the file

$ tail -20 science.txt displays the last 20 lines of the file

$ grep ‘searchedkeyword’ science.txt searches and finds the keyword in the file.(case sensitive)

$ grep -i SeaRchEdKeyWoRd science.txt case insensitive search

$ grep -i ‘SeaRched Sentence is this one’ science.txt case insensitive search

instead of i we can use;
-n precede each matching line with the line number
-v display those lines that do not match
-c print only the total count of matching lines

$ find -name “*.txt” -print finds the text files in the current directory

$ diff a.txt b.txt gives the different lines

$ wc -w science.txt gives the word count

$ wc -l science.txt gives the line count

$ cat > list1


creates a list and we can print this list by using:

$ cat list1 command line.

$ cat biglist | grep p | sort gives sorted list elements which include p

$ sort < biglist > sortedlist sorts the biglist and writes it to the sortedlist

$ ls list* outputs the filenames starting with ‘list’

$ ls *list outputs the filenames ending with ‘list’

$ ls ?un outputs the filenames ending with ‘un’ but just one letter. (e.g. sun, gun, bun)

$ man ____ gives information about the command in the underlined section.

$ whatis ____ gives information about the command in the underlined section.

$ ls -l gives detailed information about the gfiles in the directory

o:other people
rwx: read write execute
rw: read write
r: read
x: execute

$ chmod u+x TheFile adds writing permission to the user(owner) of TheFile

$ chmod go-rwx biglist to remove read write and execute permissions on the file biglist for the group and others

$ chmod 754 TheFile 7, 5, 4 represents the individual permissions for user, group, other (7:rwx, 5:rx, 4:r)

4 – stands for “read”
2 – stands for “write”
1 – stands for “execute”
0 – no permissions

$ du -s * The du command outputs the number of kilobyes used by each subdirectory.

$ df . The df command reports on the space left on the file system.

$ gzip science.txt Compresses into a gzip file

$ gunzip science.txt.gz De-compresses into the original file

$ tar cvf New.tar addthisfileintotar Create a tar file called New and add this file.

$ tar xvf New.tar Extracts the tar file

$ zcat science.txt.gz reads zipped files without unzipping

$ file * Classifies the files in the current directory ( folder, text, gzip, etc.)

$ name=Berk
$ echo Hello $name Prints ‘Hello Berk’

$ sha1sum FileName | grep e509760917361307015 Compares the checksum of a downloaded file and the calculated one.

$ gpg -c file Encrypts file

$ gpg file.gpg Decrypts file


User Related:

$ id Shows the active user id with login and group

$ last Shows last logins on the system

$ who Shows who is logged on the system

$ groupadd admin Adds group “admin”

$ useradd -c “Jermal Smith” -g admin -m sam Creates user “sam” and adds to group “admin”

$ userdel sam Deletes user sam

$ adduser sam Adds user “sam”

$ usermod Modifies user information


System Statistics:

$ top Displays the top CPU processes (Ctrl+C to exit)

$ vmstat 2 Displays virtual memory statistics

$ sudo tcpdump -i eth0 Captures all packets flows on interface eth0

$ sudo tcpdump -i eth0 ‘port 80’ Monitors all traffic on port 80 ( HTTP )

$ lsof Lists all open files belonging to all active processes.

$ lsof -u myuser Lists files opened by specific user

$ watch df -h Shows changeable data continuously


System Info:

$ uname -a Displays Linux system information

$ uname -r Displays kernel release information

$ uptime Shows how long system running + load

$ hostname Shows system host name

$ hostname -i Displays the IP address of the host

$ last reboot Shows system reboot history

$ date Shows the current date and time

$ cal Shows this month calendar

$ whoami Shows who you are logged in as


Hardware Info:

$ dmesg Detected hardware and boot messages

$ cat /proc/meminfo Hardware memory information

$ cat /proc/cpuinfo CPU model information

$ cat /proc/interrupts Lists the number of interrupts per CPU per I/O device

$ sudo lshw Displays information on hardware configuration of the system

$ lsblk Displays block device related information in Linux (sudo yum install util-linux-ng)

$ free -m Displays used and free memory (-m for MB)

$ lsusb -tv Shows USB devices

$ dmidecode Shows hardware info from the BIOS

$ hdparm -i /dev/sda # Shows info about disk sda

$ hdparm -tT /dev/sda # Do a read speed test on disk sda

$ badblocks -s /dev/sda # Test for unreadable blocks on disk sda


How to Remove Users From the Office 365 Deleted Users

And… its time to purge those 365 deleted users. Although we can wait for the retention policy to do it for us. I wanted to do this “now”.

I had wrote the following steps in the past and thought I would share here.

[Press Start]

To delete the account for one or more users

Sign in to Office 365 with your work or school account.

Go to the Office 365 admin center.

Go to Users > Active Users.

Choose the names of the users that you want to delete, and then select DELETE Delete.

In the confirmation box, select Yes.



Well, not so fast. The deleted users is not fully gone yet. It takes 30 days after you have deleted the user for it to purge from Office 365. However there is a way to do this faster

[Press Start]

Connect to Exchange Online using the Windows Azure Powershell module.

To connect you enter the following cmdlet’s:

  1. Store your credetials (this is stored in memory): $msolcred = get-credential
  2. Connection to Office 365: connect-msolservice -credential $msolcred

Once connected you can issue the following command to list deleted users:

get-msoluser –returndeletedusers -maxresults 100

To remove a deleted user permanently:

remove-msoluser –userprincipalname -RemoveFromRecyclebin

If you had multiple users, the following cmdlet would work to remove all deleted users recycle bin:

get-msoluser –returndeletedusers -maxresults 100 | remove-msoluser -removefromrecyclebin -force

That’s it… Your done. Good Luck

Original Post of mine can be found here

Quick How To Share a Document with OneDrive for Business

You can share file(s): Documents and such with Onedrive for Business

1.      In the file list, right-click a document, or select a document and then select Share.

2.      Select Get a link.

3.      Choose who to share with, and if they can view or edit the file.

4.      To share with people inside your organization, choose:

5.      View link – account required – people inside your organization can view, copy, or download the document.

6.      Edit link – account required – people inside your organization can edit, copy, or download the document.

7.      To share with people outside your organization, choose:

8.      View link – no sign-in required – people outside your organization can view, copy, and download the document.

9.      Edit link – no sign-in required – people outside your organization can edit, copy, and download the document.

10.  For external links, select SET EXPIRATION, and choose when you want the link to expire.

11.  Click Copy and paste the link in an email or post it.

Note: Links created that don’t require a sign-in can be opened by anyone, so make sure the content can be shared publicly. Consult your Corporate Information Security Policy and IT if needed.

Note: Sharing of folders is not possible at this time.

Exchange Remote PowerShell Broken in Windows 10 Anniversary Update

So you updated to Windows 10 Anniversary and now have found yourself unable to connect to a remote PowerShell sessions. I noticed this in my management of Exchange Online in Office 365 after upgrading to Windows 10 version 1607 aka Anniversary Edition.

In my attempts to connect, as I have done in the past: I encountered a error message:


Later comparing this with my down-level installs of Windows 10 and Server 2012 R2 this issue does not exist. So what changed?

It seems that the version of PowerShell which was updated may have something to do with this issue. This is when I attempted to run PowerShell in a down-level mode.

This is done by issuing the following command in an elevated command prompt (Run As Administrator): PowerShell.exe -Version 2.0

From this point we can now connect without issue.

Hope this helps

Office 365 IRM & Azure Rights Management

I recently configured IRM to protect documents and email communications as part of a security initiative.

Information Rights Management (IRM) in Exchange Online uses Active Directory Rights Management Services (AD RMS), an information protection technology service in Office 365. IRM protection is applied to email by applying an AD RMS rights policy template to an email message. Usage rights are attached to the message itself so that protection occurs online and offline and inside and outside of your organization’s firewall

Need to know info:

  • Time to complete this task: 30-60 minutes
  • You need to be assigned admin permissions to manage IRM
  • Knowledge of using Windows PowerShell to connect to Exchange Online

Steps Taken:

Step 1: Activating Azure Rights Management

  1. Log into the Office 365 admin center
  2. In the left pan expand the services settings
  3. Click Rights Management
  4. On the Rights Management page, click Manage
  5. On the Rights Management page, click Activate
  6. You will be prompted with the question: Do you want to activate Rights Management? click activate.

You should now see Rights Management is activated

Step 2: Using Exchange Management Shell to log into Office 365

Here I use PowerShell ISE to step through he process

# Login to the Office 365 Account

Set-ExecutionPolicy RemoteSigned

$UserCredential = Get-Credential

$Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri -Credential $UserCredential -Authentication Basic -AllowRedirection

Import-PSSession $Session

Step 3: Use the Exchange Management Shell to configure the RMS Online key sharing location in Exchange Online

#Displaying the IRM Configuration


# List of Locaitons

#North America

#European Union


#South America

#Office 365 for Government (Government Community Cloud)

Set-IRMConfiguration -RMSOnlineKeySharingLocation “”

#Checking that the configraiton was applied


Step 4: Importing Trusted Publishing Domain (TPD) from RMS Online

Import-RMSTrustedPublishingDomain -RMSOnline -name “RMS Online”

Test-IRMConfiguration -RMSOnline

Step5: Enabling IRM in Exchange Online

Set-IRMConfiguration -InternalLicensingEnabled $true

Step 5: Testing the IRM configuration


Test-IRMConfiguration -Sender jsmith@jermsmit.tld

Expected Results should show that each area verified has passed

Ref Links:

Summery  image of my PowerShell ISE


VMware vCenter 6 Phantom Snapshots

I’ve been using vCenter 6 for a while now and noticed an odd issue pertaining to snapshots. It seems that all guest show a “revert to current snapshot” state even if a snapshot does not actually exist.

However viewing under the Snapshot Manger… shows no existing snapshots associated with the virtual machine guests.

I’ve noticed this this issue does not exist when using the vSphere Web Client.

These symptoms have been confirmed by VMware official in the following KB:

For now there are no resolution steps…

Symptom Recap:

  • There are no snapshots on virtual machine(s).
  • Virtual machines show Revert to current snapshot (right-click on the virtual machine > Snapshot > Revert to current snapshot) enabled in vSphere Client when connected to the vCenter Server 6.0.
  • When viewing the Snapshot Manager (right-click on the virtual machine > Snapshot > Snapshot Manager) for the virtual machine in the vSphere Client, there are no snapshots present.
  • Directly logging into the ESXi host using the vSphere Client shows the Revert to current snapshot grayed out.
  • Creating and deleting a snapshot does not resolve this issue.
  • In the vSphere Web Client Revert to current snapshot appears grayed out.

Work around: 

  1. Ignore the vSphere Client results and use the vSphere Web Client
  2. Use PowerCli to display snapshots.

Example command I like to use:


ntopng on Ubuntu 14.04

I just completed my ntopNG appliance setup. Once more I can look into my network traffic to get an idea of what’s going on.

Below you will find the steps to complete the install

Here are the steps

Log into the ubuntu server host and issue the following commands:

  1. sudo into root: sudo -i
  2. wget
  3. dpkg -i apt-ntop-stable.deb
  4. apt-get update
  5. apt-get -y install pfring nprobe ntopng ntopng-data n2disk nbox
  6. service apache2 restart

The steps provided here are the official directions for their stable build packages.

Please note you will need to have a management and monitoring interface for your configuration.

In my configuration, I will be listening on a mirrored port to capture network traffic to be displayed under ntopNG


Are you interested in learning more about Ubuntu.  Check out the following book:  Ubuntu Unleashed 2016 Edition

Using Get-SPWebTemplate to list available site templates in SharePoint 2013

In this tech-short we will go over a simple yet effective way to list out the available site templates in SharePoint 2013.

Using the New-SPSite PowerShell cmdlet allows you to specify the name of a template to use. In my case I was unaware of the name of available templates in my SharePoint installation.  Using the Get-SPWebTemplate command to produce a list for me.


  1. Open the SharePoint 2013 Management Shell
  2. The the following command: Get-SPWebTemplate | Sort-Object “Name”

The results are a list Templates which could be used in this environment.


If you wanted to do the same with PowerShell locally or remote the following steps can be taken.

Open PowerShell and issue the following commands:

  1. New-PSSession -ComputerName SharePoint
  2. Add-PSSnapin Microsoft.SharePoint.Powershell
  3. Get-SPWebTemplate | Sort-Object “Name”