mirror of
https://github.com/yuriskinfo/cheat-sheets.git
synced 2025-12-21 13:23:11 +01:00
@@ -1,10 +1,9 @@
|
|||||||
= Checkpoint `cpstat` diagnostics and information tool cheat sheet
|
= Check Point `cpstat` diagnostics and information tool cheat sheet
|
||||||
|
|
||||||
Author: Yuri Slobodyanyuk, https://www.linkedin.com/in/yurislobodyanyuk/
|
|
||||||
|
|
||||||
NOTE: The tool is to be run in Expert mode. It is available on both Management Server and Gateway. The available *flavor* options depend on the blades enabled and their subscription status, also on platform used. To know what options are available on your specific Checkpoint - run `#cpstat` without any switches.
|
NOTE: The tool is to be run in Expert mode. It is available on both Management Server and Gateway. The available *flavor* options depend on the blades enabled and their subscription status, also on platform used. To know what options are available on your specific Checkpoint - run `cpstat` without any switches.
|
||||||
|
Example of using: `cpstat os -f ifconfig`
|
||||||
|
|
||||||
status: Work in Progress.
|
|
||||||
|
|
||||||
:toc:
|
:toc:
|
||||||
|
|
||||||
|
|||||||
File diff suppressed because it is too large
Load Diff
@@ -31,8 +31,30 @@ Status: Work in progress.
|
|||||||
|*show vpc peer-keepalive*
|
|*show vpc peer-keepalive*
|
||||||
| Display real-time stats on peering keepalives: last send/receive time, IP of the peer, port and protocol used, vrf for communicaiton.
|
| Display real-time stats on peering keepalives: last send/receive time, IP of the peer, port and protocol used, vrf for communicaiton.
|
||||||
|
|
||||||
|
|*show feature*
|
||||||
|
|Show enabled features, make sure FEX is on.
|
||||||
|
|
||||||
|
|*show fex [_fex-num_] [detail]*
|
||||||
|
| Show FEX, optionally with details - FEX associated number, state
|
||||||
|
(Online/Offline/Connecting), model, serial number (of the module). If _detail_,
|
||||||
|
then also show log of the last registration/offline/online of the FEX.
|
||||||
|
|
||||||
|
|*show interface fex*
|
||||||
|
| In addition to above, show physical interface names (uplinks) where FEX is connected on
|
||||||
|
Nexus and its state.
|
||||||
|
|
||||||
|
|*reload fex _fex-num_*
|
||||||
|
| Reload the specified FEX (it should be online for this).
|
||||||
|
|
||||||
|
|*show inventory fex _fex-num_*
|
||||||
|
|Show hardware info and serial numbers of the FEX chassis, network module, fans,
|
||||||
|
power supplies.
|
||||||
|
|
||||||
|
|*show environment fex _fex-num_/all*
|
||||||
|
|Show power consumed, temperature.
|
||||||
|
|
||||||
|
|*show int port-channel _n_ fex*
|
||||||
|
|Show physical interfaces pinned to a given port-channel.
|
||||||
|
|
||||||
|===
|
|===
|
||||||
|
|
||||||
|
|||||||
@@ -87,6 +87,25 @@ packets on CLI. It gives definite answers whether a packet reached the
|
|||||||
Fortigate, whether it was dropped by firewall rules, what was incoming/outgoing
|
Fortigate, whether it was dropped by firewall rules, what was incoming/outgoing
|
||||||
interface, and contents of the packet if needed.
|
interface, and contents of the packet if needed.
|
||||||
|
|
||||||
|
`verbosity` - level of detail to present, can be one of:
|
||||||
|
|
||||||
|
1 - packets' header, includes IP addresses, ports, and flags if set.
|
||||||
|
|
||||||
|
2 - packets' header and data for IP packet, i.e. same as above plus contents of
|
||||||
|
the packet.
|
||||||
|
|
||||||
|
3 - same as 2 above plus Ethernet header.
|
||||||
|
|
||||||
|
4 - packets' header (no contents) plus incoming/outgoing interface name for each
|
||||||
|
packet. This gives the indication whether the packet passed the Fortigate or was
|
||||||
|
dropped by it.
|
||||||
|
|
||||||
|
5 - same data as `4` plus contents of IP packets.
|
||||||
|
|
||||||
|
6 - packets' header starting from Ethernet plus contents and incoming/outgoing
|
||||||
|
interface names.
|
||||||
|
|
||||||
|
|
||||||
`count` - number of packets to capture, integer. If not set, will be capturing
|
`count` - number of packets to capture, integer. If not set, will be capturing
|
||||||
until the SSH/console timeout or until stopped with `CTRL + C`.
|
until the SSH/console timeout or until stopped with `CTRL + C`.
|
||||||
|
|
||||||
@@ -138,9 +157,21 @@ processes to show with _num-processes_, and use `detail` to get verbose output
|
|||||||
|*get hardware memory*
|
|*get hardware memory*
|
||||||
| Show memory statistics: free, cached, swap, shared
|
| Show memory statistics: free, cached, swap, shared
|
||||||
|
|
||||||
|
|*dia hardware sysinfo conserve*
|
||||||
|
|Info whether the conserve mode on or off, total memory available, conserve mode
|
||||||
|
thresholds `red` and `green`
|
||||||
|
|
||||||
|*execute sensor list*
|
|*execute sensor list*
|
||||||
|List current readings of all sensors present on this model of the Fortigate. Larger models (1500 and up) show CPUs voltage, fan speeds, temperature, power supply voltage and more.
|
|List current readings of all sensors present on this model of the Fortigate. Larger models (1500 and up) show CPUs voltage, fan speeds, temperature, power supply voltage and more.
|
||||||
|
|
||||||
|
|*dia sys flash list*
|
||||||
|
|Show contents of the flash memory holding FortiOS firmware images. One of the images
|
||||||
|
will have `Active` set to `yes`, which means it is the used one.
|
||||||
|
|
||||||
|
|*diagnose hardware deviceinfo disk*
|
||||||
|
|Show all storage attached to the firewall, including disk type, volume, free
|
||||||
|
space.
|
||||||
|
|
||||||
|===
|
|===
|
||||||
|
|
||||||
|
|
||||||
@@ -678,6 +709,10 @@ just clear Fortigate DHCP database and will start over allocating again. You can
|
|||||||
|Description
|
|Description
|
||||||
|
|
||||||
|
|
||||||
|
|*diagnose firewall auth list*
|
||||||
|
|List all authenticated and known by firewall usernames. It does not matter what
|
||||||
|
the source is - LDAP/SSO/etc. Also shows client's IP, idle time, duration.
|
||||||
|
|
||||||
|*diagnose debug app fnbamd -1*
|
|*diagnose debug app fnbamd -1*
|
||||||
|Enable debug for authentication daemon, valid for ANY remote authentication - RADIUS, LDAP, TACACS+.
|
|Enable debug for authentication daemon, valid for ANY remote authentication - RADIUS, LDAP, TACACS+.
|
||||||
|
|
||||||
|
|||||||
Reference in New Issue
Block a user