Community
- Command Central
- MVP Program
- Monthly Mission
- Blogs
- Groups
- Events
- Media Vault
Products
- Observability
- Network Management
- Application Management
- IT Security
- IT Service Management
- System Management
- Database Management
Content Exchange
- SolarWinds Platform
- Server & Application Monitor
- Database Performance Analyzer
- Server Configuration Monitor
- Network Performance Monitor
- Network Configuration Manager
- SQL Sentry
- Web Help Desk
Free Tools & Trials
Store

Do you have a Checkpoint UTM 570?

chris.lapoint

If so, please respond. I'd like to partner with you on creating a device template for use within NCM.

Thanks in advance for your help!

Find more posts tagged with

Accepted answers

All comments

aLTeReGo

I have a pair of UTM 1070 appliances running in an HA cluster if that's at all helpful.

chris.lapoint

Great! I would assume the CLI interface is similar to the UTM 570. Would you mind filling out the attached device template questionnaire? It asks you to document the commands/prompts required to download the running and startup configs from the device.

Thanks!

Questionnaire for New Devices.doc

aLTeReGo

Great! I would assume the CLI interface is similar to the UTM 570.

Yes the CLI is identical to the 570, and all the UTM appliances for that matter including the Connectra appliance. The only exception are the UTM-Edge devices. These edge devices are the little SOHO appliances that are basically Linksys routers on crack.

Now you need to appreciate that the UTM appliances that you want to create a template for do not have a running/starting configuration like a Cisco router. They have three different types of configuration backups. Each of which has their pluses and minuses. I'm personally a fan of the upgrade_export because it doesn't require you to stop the Check Point services like a snapshot does, and it's hardware and OS agnostic unlike a backup. It's really a personal choice.

[upgrade_export]

It doesn't backup any OS (i.e. SPLAT) settings, it only backups up Check Point settings
It will let you export on one OS and then import on a different OS (i.e. go from Windows to SPLAT)
You can upgrade_import on different hardware (i.e. go from IBM to HP)
You can restore an export from an older version to a newer version of CheckPoint. A SPLAT backup/restore requires that you have the exact same versions. Note that when upgrading from an older to newer version, you must use the newer version's upgrade_export utility to create the export file.
It restores the product list as well. The SPLAT restore command won't restore the Check Point settings if you don't have the exact same products (and product versions) installed.

[backup]

A SPLAT backup will back up both the SPLAT OS settings as well as the CheckPoint settings
Basically it's an upgrade_export with OS settings added in
Restoring a backup file requires the exact same software installation. I.e. you can't restore a backup from R55 on to R60 (the HFA level must match as well). The installed product list must match as well. Note that you can
still restore the OS settings even if your installed Check Point product list doesn't match.
The SPLAT OS settings are hardware specific. If you restore the system settings you must restore on the same hardware. However, if you only restore the Check Point settings you can restore on different hardware. Restoring just the Check Point settings is essentially the same thing as doing an "upgrade_import" of an exported file.

[snapshot]

A snapshot is even better than a backup since it contains binary files. I.e. you can revert from R60 to R55 with a snapshot. The downside to this is that a snapshot file is much larger than an upgrade_export or backup
file.
A snapshot can also roll you forward for minor software changes. For example if I revert from R60 HFA05 to HFA01 I can later revert back to R60 HFA05 from R60 HFA01
A snapshot cannot revert to a newer major release of Check Point. I.e. you can't revert from R55 to R60.
If you're reinstalling SPLAT on the same hardware you don't have to install any HFA's or change any configuration. Simply reverting to your saved snapshot file will restore all configurations and HFAs. The only
stipulation is that the major software version must match. I.e. a R60 snapshot file will only work on a R60 install (regardless of HFA level).
You can only revert on the same hardware, since the snapshot file contains hardware specific SPLAT settings.

So I guess my question is, which one would you like me to do?

chris.lapoint

Based on your explanation, I think I'm most interested in upgrade_export and backup. Is there a way to show the upgrade_export and backup files on the command line? This would allow us to do a line by line transfer. Otherwise, we'll need a way to transfer the upgrade_export and backup files (e.g. TFTP or SCP).

aLTeReGo

It's worth noting that users are no longer allowed to execute snapshots from the command-line under SecurePlatform (R70 and up). OS snapshots are still allowed however via the WebUI.