https://help.checkpoint.com/s/
Learn>Product Evaluation>All-in-One-Evaluation
Download the license file

cplic put -l LICENSEFILE.lic
cplic print -x (to get the hash and del old ones)
cplic del KEY_HASH (remove all the old ones)
cplic print -t (to check whether central or local)
cpstop
cpstart

upload the license file on Smart Update as well and attach. Dettach all the old ones.

How to import multiple objects into R80.x Management database using .csv file and then add them to a group:
https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113078
https://community.checkpoint.com/t5/General-Management-Topics/Format-of-csv-file-to-add-object-in-group/td-p/8987

.csv files needs to be where you will be running the commands from:

Create the .csv file:

#cat networks.csv

name,subnet,subnet-mask
network1,10.10.10.0,255.255.255.0
network2,20.20.20.0,255.255.255.0
network3,30.30.30.0,255.255.255.0

Note: using underscore character in .csv file (for example, “network1_1”) can cause errors. Use the hyphen instead.

Run the API command:
#mgmt_cli add network –batch networks.csv

Then to add the objects to the right group use:

mgmt_cli set group –batch group-members_full_csv.csv

The CSV should have the following header row:

name,members.add

The name field is for the group and the members.add field will be the host object to add to the group.

The rest of the body of the CSV would then be filled in as you wish:

group1,host1

group1,host2

group1,host3

group2,host1

group2,host2

group2,host3

 

fwaccel off (turn SecureXL off)

vpn debug trunc
vpn debug on
vpn debug on TDERROR_ALL_ALL=5

Replicate the issue or wait for some time for VPN re-establishment

vpn debug off

vpn debug trunc off

fwaccel on (turn SecureXL on)

upload the following files to Checkpoint TAC so that they can run it inside their IKE utility:
$FWDIR/log/ike.elg
$FWDIR/log/vpnd.elg

1. Enable Config Sync (untick on both)(commit).
2. Specify Panorama Server on HA Firewalls and Enable Policy, Objects and Templates options (commit).
3. Add Firewalls as Manages devices in Panorama using serial numbers (Tick Group HA Peers) (commit Panorama).
4. Import Device configuration to Panorama (Post Rule/Leave ticked) (Primary)
5. Import Device configuration to Panorama (Post Rule/Leave ticked) (Secondary)
6. Commit (Panorama) (Creates Device Groups and Templates for both).
7. Remove Secondary Template and Device Group and Add both to the Primary Device Group and Template.
8. Export Configuration (Push and commit) Device Group config to Secondary only and Make the Primary suspended for Secondary to takeover.
9. Export Configuration (Push and commit) Device Group config to Primary now and Failback to the Primary.
(Both Should be showing In Sync under Managed Devices under Device Group and Templates)

Why conduct a penetration test?

An organisation should carry out a penetration test:

• In response to the impact of a serious breach on a similar organisation;
• To comply with a regulation or standard, such as the PCI DSS (Payment Card Industry Data Security Standard) or the EU GDPR (General Data Protection Regulation);
• To ensure the security of new applications or significant changes to business processes;
• To manage the risks of using a greater number and variety of outsourced services; and/or
• To assess the risk of critical data or systems being compromised.

When penetration testing is conducted within the UK, there are a number of laws that govern the activities that form part of a penetration test.

For the majority of tests, these laws include the following:

• UK Computer Misuse Act 1990
• UK Data Protection Act 1998
• Human Rights Act 1998
• Police and Justice Act 2006

In order to ensure that penetration testing is conducted in line with UK law and also to ensure that the test is conducted as efficiently as possible, a testing consent form must always be used to capture the exact scope of the test and provides those responsible for an organisation’s infrastructure with a means of providing their consent.

(use pscp for windows)
https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html

ASA:

ssh scopy enable

PC:
pscp C:\Users\fali\Desktop\asa964-17-lfbff-k8.SPA Nettitude@196.29.167.170:disk0:asa964-17-lfbff-k8.SPA

(use pscp -1 …… for version 1)

ASA: 

no boot system disk0:/asa952-6-lfbff-k8.SPA
boot system disk0:/asa964-17-lfbff-k8.SPA
boot system disk0:/asa952-6-lfbff-k8.SPA
wr mem
reload in 8:00

Enforce DAP Based on CSD Host Scan for Domain Registry Key

Note:  (Enable: Check Cisco Security Discovery option  under the profile):

SSL Protocol: These are the following list of protocols which have been released till date:

• SSL 1.0, 2.0 and 3.0
• TLS 1.0 (or SSL 3.1, released in 1999)
• TLS 1.1 (or SSL 3.2, released in 2006)
• TLS 1.2 (or SSL 3.3, released in 2008)

1.DAP rules (Dynamic Access Policy)(NAC)(e.g. if firewall present on client machine etc.)
2.User Profile rules (User Account)(e.g. Two simultanous logins)
3.User Profile Group rules (Group Policy attached to the User profile)(e.g. WebTypeACL)
4.Connection Profile Group rules (selected at pre-login based on URL, Alias or Cert)(e.g. no http from portal)
DefaultWebVPNGroup
DefaultRAGroup
Custom connection profile
5.DfltGrpPolicy Group rules (e.g. connection time 33 mins)

Connection Profile (aka Tunnel Group) controls the “Pre-logoin Policy”

After login, ASA knows who the user is and post-login policies(permissions,authorizations,restrictions,etc) come. Top always win if there is conflict.

Example flow.