Enable SNMP monitoring in CheckPoint

Step 1. Turning on SNMP extension
(to enable extended CP MIBS – http://www.oidview.com/mibs/2620/CHECKPOINT-MIB.html)
[code]cpconfig

Configuration Options:
———————-

(2) SNMP Extension

[/code]
Press the corresponding number to access SNMP extension configuration. In our case it is – “2”.
[code]Configuring SNMP Extension…
=============================
The SNMP daemon enables Check Point products module
to export its status to external network management tools.
Would you like to enable Check Point products SNMP daemon ? (y/n) [y] ?
[/code]
Press “y” or [Enter] key to enable the SNMP extension.[/code]
[code]Thank You…
You have changed Check Point products Configuration.
You need to restart ALL Check Point modules (performing cpstop & cpstart)
in order to activate the changes you have made.
Would you like to do it now? (y/n) [y] ?
[/code]
Press “y” or [Enter] key again to apply the changes.

2. Configuring SNMP users

[code]snmp user add authuser USER pass PASSWORD1 priv PASSWORD2
service snmpd restart
[/code]

3. Adding SNMPd to automatic startup sequence
[code]
chkconfig snmpd on
[/code]

Source: http://www.checkpoint.com/techsupport/downloads/docs/firewall1/r54/SNMP_Add-on_Manual.pdf

Junos Pulse VPN client install issue – roll back

If you have many VPN clients (or network filters) installed on your system, Junos Pulse install may fail due to low maxfilters value in registry. Install hangs for some time and then rolls back.
If rollback is interrupted, or if install is triggered by web-installer it results is non-working VPN client with empty connection window.
This means that necessary services to run the clinet are missing – only UI files are installed.

To resolve the issue, you need to edit the Windows Registry key:
[code]HKLM/SYSTEM/CurrentControlSet/Control/Network/MaxNumFilters[/code]

This value defines the maximum number of network filter drivers allowed on the computer.

Try to change this value to 14 (maximum value), and the Junos Pulse install should finish successfully.

Source: http://forums.juniper.net/t5/SSL-VPN/Junos-Pulse-empty-window-Win-7-64-bit/td-p/96592/page/3

Cisco VPN client and 3G modems

Cisco VPN client is not working with 3G modems out of the box on Windows 7. The VPN will come up, but no traffic will pass throught the tunnel.
The release notes for Cisco VPN Client 5 state: The VPN Client on Windows 7 does not support WWAN devices (also called wireless data cards).

To fix the problem you will need to update your DNE component:

For 32-bit OS: ftp://files.citrix.com/dneupdate.msi
For 64-bit OS: ftp://files.citrix.com/dneupdate64.msi

After a restart VPN will work fine.

Source: https://supportforums.cisco.com/thread/2017102

CheckPoint advanced VPN Debugging

CheckPoint shows basic VPN information in SmartDashboard VPN section.
but sometimes there is not enough information on certain problems (like id mismatch).
There is a way to obtain more detailed logs (sort of Cisco’s “debug crypto ipsec” command).

To turn on VPN debug log enter the following command:

[code] vpn debug trunc; vpn debug ikeon[/code]

This will enable log output to $FWDIR/log/ike.elg
To read the file output in a more convenient way, download Checkpoint’s *IKEView.exe* utility (Windows only):

http://pingtool.org/downloads/IKEView.exe

Don’t forget to stop the debug with command:

[code] vpn debug off; vpn debug ikeoff [/code]

Source: sk33327