Tag: Gaia

Posted on

Gaia: Backup and Restore From CLI (Clish)

Gaia: Backup and Restore From CLI (Clish)

This article provides a quick tutorial on how to make a Gaia: backup and restore from the CLI (Clish shell) in Gaia. Depending which version of Gaia you are using, you may or may not have the option to perform a backup or restore from the Web GUI under the “Maintenance” section or you may only have SSH access – having the skill to do this from the command line is important either way.

For the methods below the following apply:

  • x.x.x.x should be replaced by the IP of the server
  • myuser should be replaced by a valid username for the server.
  • mybackupfile.tgz should be replaced by the name of your backup file
  • You will be prompted for the password on the command line if you are using FTP or SCP

Backup

The add backup command is what we use to initiate a backup from the CLI. We also need to pass a parameter to define where the backup is to be saved: local, FTP, TFTP or SCP:

  • To save a backup locally:
    • add backup local
  • To save a backup on a remote server using FTP:
    • add backup ftp ip x.x.x.x username myuser password plain
  • To save a backup on a remote server using TFTP:
    • add backup tftp ip x.x.x.x
  • To save a backup on a remote server using SCP:
    • add backup scp ip x.x.x.x username myuser password plain
add backup local
add backup local

Note:

 

  • You can use the show backups command to see the status of any current and completed backups.
  • Backup configurations on Check Point appliances are stored in /var/log/CPbackup/backups/
  • Backup configurations on Open Servers are stored in /var/CPbackup/backups/

 

Restore

To restore a backup we use the set backup restore command and as with the backup, we pass the relevant parameters:

  • To restore a local backup:
    • set backup restore local <TAB>
  • To restore a backup from a remote server using FTP:
    • set backup restore ftp ip x.x.x.x file mybackupfile.tgz username myuser password plain
  • To restore a backup from a remote server using TFTP:
    • set backup restore tftp ip x.x.x.x file mybackupfile.tgz
  • To restore a backup from a remote server using SCP:
    • set backup restore scp ip x.x.x.x username myuser password plain

Remember!

  • Restore is only allowed using the same Gaia version on the source and target computers.
  • Restore is only allowed using the same appliance type on the source and target computers.
  • The backup file name generated by the backup command should not be renamed and must not contain spaces.
  • When backing to an SCP or FTP server, the backup file is put in the user’s home folder. When restoring from SCP or FTP the backup file is taken from the user’s home folder.
  • This is not applicable to VSX – to backup and restore VSX, see sk100395 for details.

Related posts:

Posted on

Checkpoint: Long Delay When Logging In Via SSH or Console

How to mitigate the issue where this a long delay when logging in via SSH or console.

When an SSH session is initiated to a linux box, the SSH server tries to perform a lookup on the client’s IP; in certain situations this is not going to be possible, e.g.:

  • the configured DNS server is offline
  • the firewall / smartcentre cannot talk to the configured DNS because of a policy
  • the external internet connection is down etc.etc.

This DNS timeout manifests itself as an incredibly long delay for the user trying to log in – fortunately there is a very quick fix for this:

  • delete the nameservers entirely!
  • configure nameservers that the machine is able to reach
  • use internal nameservers if your internet connection is flaky

This is the case for all Checkpoint linux-based machines as well as IPSO and Gaia.

Related posts:

Posted on

Checkpoint: Best Practice Kernel Parameters for ClusterXL Stability

This article details how to configure the best practice kernel parameters to ensure ClusterXL stability.

It is recommended to set ALL of those values on your cluster – also see sk92723 on Cluster flapping prevention.

Make sure the changes to the kernel parameters are performed on both members!

To test (will not survive a reboot):

fw ctl set int fwha_freeze_state_machine_timeout 200
fw ctl set int fwha_policy_update_timeout_factor 3
fw ctl set int fwha_pnote_timeout_mechanism_monitor_cpu 1
fw ctl set int fwha_pnote_timeout_mechanism_cpu_load_limit 80
fw ctl set int fwha_if_connectivity_tolerance 3

Once you are happy with the above you can enter the values into the $FWDIR/boot/modules/fwkern.conf file to make sure that the parameters stick after a reboot.

If the fwkern.conf doesn’t exist create it using the “touch” command:

[Expert@fw-trinity:0] # touch $FWDIR/boot/modules/fwkern.conf

Using the vi editor, insert the below commands into the fwkern.conf file:
fwha_freeze_state_machine_timeout = 200
fwha_policy_update_timeout_factor = 3
fwha_pnote_timeout_mechanism_monitor_cpu = 1
fwha_pnote_timeout_mechanism_cpu_load_limit = 80
fwha_if_connectivity_tolerance = 3

Related posts: