Checkpoint Gaia Cli Commands



This section contains a summary of the Gaia CLI commands that configure Link Aggregation. Link Aggregation (Bonding) - Quick Reference for Gaia Clish Commands This is a quick reference for Link Aggregation commands. Use these commands to configure Link Aggregation. Like a cheat sheet for CLI commands? CHECKPOINT GAIA CLISH COMMANDS. Save config: save the current configuration: show commands: shows all commands.

In This Chapter

This chapter gives an introduction to the Gaia command line interface (CLI).

The default shell of the CLI is called clish.

To use the CLI:

  1. Connect to the platform using a command-line connection (SSH or a console) over a TCP/IP network.
  2. Log on using a user name and password.

    Immediately after installation, the default user name and password are admin and admin.

Saving Configuration Changes

Configuration changes you enter using the CLI are applied immediately to the running system. To ensure that these changes remain after you reboot, that is, to save your changes permanently, run save config at the CLI prompt.

Commands and Features

Gaia commands are organized into features. A feature is a group of related commands.

Commands have the syntax

The most common operations are show, add, set, delete

Checkpoint Gaia Cli Commands

The 4 main operations

Description

set

Sets a value in the system.

show

Shows a value or values from the system.

delete

Deletes a value from the system.

add

Adds a new value to the system.

Other operations

Description

save

Saves the configuration changes made since the last save operation.

reboot

Restart the system.

halt

Turns the computer off.

quit

Exits from the CLI.

exit

Exits from the shell.

Start

Starts a transaction. Puts the CLI into transaction mode. All changes made using commands in transaction mode are applied at once or none of the changes are applied based on the way transaction mode is terminated.

commit

Ends transaction by committing changes.

rollback

Ends transaction by discarding changes.

expert

Enter the expert shell. Allows low-level access to the system, including the file system.

ver

Shows the version of the active Gaia image

revert

Revert the database

help

Get help on navigating the CLI and some useful commands.

To do this

Type

Shows all commands that the user has permissions to run

Show a list of all features

Shows all commands for a specific feature

For example

Show all the possible operations

For example

Show all commands per operation, per feature

For example

At the --More-- prompt:

To do this...

Type

To see the next page.

<SPACE>

To see the next line.

<ENTER>

To exit to the CLI prompt

<Q> or <q>

Command Completion

You can automatically complete a command. This saves time, and can also help if you are not sure what to type next.

Press ...

To do this...

<TAB>

Complete or fetch the keyword. For example

<SPACE> <TAB>

Show the arguments that the command for that feature accepts. For example:

<ESC><ESC>

See possible command completions. For example

?

Get help on a feature or keyword. For example

UP/DOWN arrow

Browse the command history

LEFT/RIGHT arrow

Edit command.

Enter

Run a command string. The cursor does not have to be at the end of the line.

You can usually abbreviate the command to the smallest number of unambiguous characters.

Command History

You can recall commands you have used before, even in previous sessions.

Command

Description

Recall previous command.

Recall next command

history

Show the last 100 commands.

!!

Run the last command.

!nn

Run a specific previous command: The nn command.

!‑nn

Run the nnth previous command. For example, entering !‑3 runs the third from last command.

!str

Run the most recent command that starts with str.

!?str?

Run the most recent command containing str. The trailing ? may be omitted if str is followed immediately by a new line.

!!:s/str1/str2

Repeat the last command, replacing str1 with str2

Command Reuse

You can combine word designators with history commands to refer to specific words used in previous commands. Words are numbered from the beginning of the line with the first word being denoted by 0. Use a colon to separate a history command from a word designator. For example, you could enter !!:1 to refer to the first argument in the previous command. In the command show interfaces, interfaces is word 1.

Word Designator

Meaning

0

The operation word.

n

The nth word.

^

The first argument; that is, word 1.

$

The last argument.

%

The word matched by the most recent ?str? search.

Immediately after word designators, you can add a sequence of one or more of the following modifiers, each preceded by a colon:

Modifier

Meaning

p

Print the new command but do not execute

s/str1/str2

Substitute new for the first occurrence of old in the word being referred to.

g

Apply changes over the entire command. Use this modified in conjunction with s, as in gs/str1/str2.

Command Line Movement and Editing

You can back up in a command you are typing to correct a mistake. To edit a command, use the left and right arrow keys to move around and the Backspace key to delete characters. You can enter commands that span more than one line.

These are the keystroke combinations you can use:

Keystroke combination

Meaning

Alt-D

Delete next word.

Alt-F

Go to the next word.

Ctrl-Alt-H

Delete the previous word.

Ctrl-shift_

Repeat the previous word.

Ctrl-A

Move to the beginning of the line.

Ctrl-B

Move to the previous character.

Ctrl-E

Move to the end of the line.

Ctrl-F

Move to the next character.

Ctrl-H

Delete the previous character.

Ctrl-L

Clear the screen and show the current line at the top of the screen.

Ctrl-N

Next history item.

Ctrl-P

Previous history item.

Ctrl-R

Redisplay the current line.

Ctrl-U

Delete the current line.

Obtaining a Configuration Lock

Only one user can have Read/Write access to Gaia configuration settings at a time. All other users can log in with Read-Only access to see configuration settings, as specified by their assigned roles.

When you log in and no other user has Read/Write access, you get an exclusive configuration lock with Read/Write access. If a different user already has the configuration lock, you have the option to override their lock. If you:

  • Override the lock, the other user stays logged in with Read-Only access.
  • Do not override the lock, you cannot modify the settings.

Use the database feature to obtain the configuration lock. The database feature has two commands:

  • lock database [override].
  • unlock database

The commands do the same thing: obtain the configuration lock from another administrator.

Description

Use the lock database override and unlock database commands to get exclusive read-write access to the database by taking write privileges to the database away from other administrators logged into the system.

Syntax

  • lock database override
  • unlock database

Comments

Use these commands with caution. The admin whose write access is revoked does not receive notification.

Configuring Configuration Lock Behavior

The behavior of the configuration lock command is configured using: config-lock.

Description

Configures and shows the state of the configuration lock

Syntax

set config-lock off
set config-lock on [timeout VALUE override]
show config-lock
show config-state

Parameters

Parameter

Description

<on |off>

Turns the configuration lock on and off.

When you turn config‑lock on, the default timeout value is 300 seconds.

on timeout

Enables config-lock for the specified interval in seconds (5‑900).

Comments

  • set config-lock on override is identical to lock database override
  • set config-lock off is identical to unlock database

32 and 64-bit Gaia Editions

Checkpoint

64-bit support for a Gaia device depends on the appliance type (for a Check Point appliance) and hardware capabilities (for open servers).

Commands

For more on supported platforms and kernels, see the R76 Release notes.

Open servers always install a 32-bit kernel, but you can switch to the 64-bit kernel using the Edition feature.

Note - The open server hardware must support 64-bit for the Edition feature to work.

Description

Use the Edition feature to change between 32 and 64-bit versions of Gaia.

Syntax

Values

Description

Sets the default edition to 32-bit

Sets the default edition to 64-bit

Comments

  • Run the command from clish.
  • The hardware platform must have at least 6 GB of memory for this to work.
  • Remember to reboot the device.

To see which edition is running:

  • Go to the WebUI System Overview pane. The edition shows in the System Overview widget.

    or

  • On the command line, run: show version os edition

Environment Commands

Description

Use these commands to set the CLI environment for a user for a particular session, or permanently.

Syntax

To show the client environment

To set the client environment

To save the client environment permanently

Parameters

Parameter

Description

all

Show all the client environment settings.

config-lock <On | Off >

The default value of the config-lock parameter. If it is set to 'on'; clish will acquire config-lock when invoked otherwise continue without a config-lock.

The value can be 'on' or 'off'.

debug <0-6>

The debug level. Level 0 (lowest) to level 6 (highest). Predefined levels are:

0 Do not do debugging. Display error messages only.

5 Show confd requests, responses.

6 Show handler invocation parameters, results.

ech-cmd <On | Off >

Echo all commands. When using the load commands command, all commands are echoed before being executed.

Default: off

on-failure <stop | continue>

  • Continue - continue running commands from a file or a script and only display error messages.
  • Stop - stop running commands from a file or a script when the system encounters an error.

Default: stop

output <pretty |structured | xml>

The command line output format.

Default: pretty

prompt VALUE

The appearance of the command prompt. To set the prompt back to the default, use the keyword default. Any printable character is allowed, as well as combinations of the following variables:

%H : Replaced with the Command number.

%I : Replaced with the User ID.

%M : Replaced with the Hostname.

%P : Replaced with the Product ID.

%U : Replaced with the User Name.

rows integer

The number of rows to show on your console or xterm. If the window size is changed the value will also change, unless the value set is to 0 (zero).

syntax-check <On | Off >

Put the shell into syntax‑check mode. Commands you enter are checked syntactically and are not executed, but values are validated.

Default: off

save clienv

Permanently save the environment variables that were modified using the set clienv commands.

Client Environment Output Format

Description

The CLI supports three output formats: pretty, structured, and xml.

Syntax

To show the output format

To set the output format

Parameters

Parameter

Description

pretty

Output is formatted to be clear. For example

Gaia> set clienv output pretty
Gaia> show user admin

Uid Gid Home Dir. Shell Real Name
0 0 /home/admin /etc/cli.sh n/a

Structured

Output is delimited by semi-colons. For example

Gaia> set clienv output structured
Gaia> show user admin
Uid;Gid;Home Dir.;Shell;Real Name;
0;0;/home/admin;/etc/cli.sh;;

xml

Adds XML tags to the output. For example

Gaia> set clienv output xml
Gaia> show user admin
<?xml version='1.0'?>
<CMDRESPONSE>
<CMDTEXT>show user admin</CMDTEXT>
<RESPONSE><System_User>
<Row>
<Uid>0</Uid>
<Gid>0</Gid>
<Home_Dir.>/home/admin</Home_Dir.>
<Shell>/etc/cli.sh</Shell>
<Real_Name></Real_Name>
</Row>
</System_User>
</RESPONSE>
</CMDRESPONSE>

Expert Mode

The default shell of the CLI is called clish. Clish is a restrictive shell (role-based administration controls the number of commands available in the shell). While use of clish is encouraged for security reasons, clish does not give access to low level system functions. For low level configuration, use the more permissive expert shell.

  • To use the expert shell, run: expert
  • To exit the expert shell and return to clish, run: exit

Expert- Password

A password protects that expert shell against authorized access. The expert password can be changed using the expert-password feature.

Description:

Use this command to set the expert password by plain text or MD5 salted hash. Use the MD5 salted hash option when upgrading or restoring using backup scripts.

Syntax:

  • set expert-password
  • set expert-password hash VALUE

Parameter

Description

hash

The password as an MD5 salted hash instead of plain text. Use this option when upgrading or restoring using backup scripts.

Example:

gw> set expert-password

Enter current expert password:

Enter new expert password:

Enter new expert password (again):

Password is only 5 characters long; it must be at least 6 characters in length.

Enter new expert password:

Enter new expert password (again):

Password is not complex enough; try mixing more different kinds of characters (upper case, lower case, digits, and punctuation).

Enter new expert password:

Enter new expert password (again):

gw> save config

Important - You must run save config to permanently set the new expert password.

Checkpoint Commands Pdf

User Defined (Extended) Commands

Description

Manage user defined (extended) commands in clish. Extended commands include:

  1. Built in extended commands. These are mostly for configuration and troubleshooting of Gaia and Check Point products.
  2. User defined commands.

You can do role based administration (RBA) with extended commands by assigning extended commands to roles and then assigning the roles to users or user groups.

Syntax

To show all extended commands

To show the path and description of a specified extended command

To add an extended command

To delete an extended command

Parameters

Parameter

Description

command

Name of the extended command

path

Path of the extended command

description

Description of the extended command

Example

To add the free command to the systemDiagnosis role and assign a user with that role:

  1. To add the free command, run

    add command free path /usr/bin/free description 'Display amount of free and used memory in the system'

  2. Save the configuration. Run

    save config

  3. Log out of Gaia and log in again.
  4. To add the free command to the systemDiagnosis role, run

    add rba role systemDiagnosis domain-type System readwrite-features ext_free

  5. To assign user john with the systemDiagnosis role, run

    add rba user john roles systemDiagnosis

Gaia: Backup and Restore From CLI (Clish)

Checkpoint Gaia Cli Commands Linux

This article provides a quick tutorial on how to make a Gaia: backup and restore from the CLI (Clish shell) in Gaia. Depending which version of Gaia you are using, you may or may not have the option to perform a backup or restore from the Web GUI under the “Maintenance” section or you may only have SSH access – having the skill to do this from the command line is important either way.

For the methods below the following apply:

  • x.x.x.x should be replaced by the IP of the server
  • myuser should be replaced by a valid username for the server.
  • mybackupfile.tgz should be replaced by the name of your backup file
  • You will be prompted for the password on the command line if you are using FTP or SCP

Backup

Cli Commands Pdf

The add backup command is what we use to initiate a backup from the CLI. We also need to pass a parameter to define where the backup is to be saved: local, FTP, TFTP or SCP:

  • To save a backup locally:
    • add backup local
  • To save a backup on a remote server using FTP:
    • add backup ftp ip x.x.x.x username myuser password plain
  • To save a backup on a remote server using TFTP:
    • add backup tftp ip x.x.x.x
  • To save a backup on a remote server using SCP:
    • add backup scp ip x.x.x.x username myuser password plain

Note:

  • You can use the show backups command to see the status of any current and completed backups.
  • Backup configurations on Check Point appliances are stored in /var/log/CPbackup/backups/
  • Backup configurations on Open Servers are stored in /var/CPbackup/backups/

Checkpoint Gaia Cli Commands Tutorial

Restore

To restore a backup we use the set backup restore command and as with the backup, we pass the relevant parameters:

  • To restore a local backup:
    • set backup restore local <TAB>
  • To restore a backup from a remote server using FTP:
    • set backup restore ftp ip x.x.x.x file mybackupfile.tgz username myuser password plain
  • To restore a backup from a remote server using TFTP:
    • set backup restore tftp ip x.x.x.x file mybackupfile.tgz
  • To restore a backup from a remote server using SCP:
    • set backup restore scp ip x.x.x.x username myuser password plain

Checkpoint Gaia Cli Commands Command

Remember!

  • Restore is only allowed using the same Gaia version on the source and target computers.
  • Restore is only allowed using the same appliance type on the source and target computers.
  • The backup file name generated by the backup command should not be renamed and must not contain spaces.
  • When backing to an SCP or FTP server, the backup file is put in the user’s home folder. When restoring from SCP or FTP the backup file is taken from the user’s home folder.
  • This is not applicable to VSX – to backup and restore VSX, see sk100395 for details.

Related posts: