Merge pull request #8 from yuriskinfo/next

Added to Nexus, Fortigate
This commit is contained in:
Slobodyanyuk
2022-12-29 10:02:02 +02:00
committed by GitHub
5 changed files with 789 additions and 750 deletions

BIN
.DS_Store vendored

Binary file not shown.

View File

@@ -1,10 +1,9 @@
= Checkpoint `cpstat` diagnostics and information tool cheat sheet
= Check Point `cpstat` diagnostics and information tool cheat sheet
Author: Yuri Slobodyanyuk, https://www.linkedin.com/in/yurislobodyanyuk/
NOTE: The tool is to be run in Expert mode. It is available on both Management Server and Gateway. The available *flavor* options depend on the blades enabled and their subscription status, also on platform used. To know what options are available on your specific Checkpoint - run `#cpstat` without any switches.
NOTE: The tool is to be run in Expert mode. It is available on both Management Server and Gateway. The available *flavor* options depend on the blades enabled and their subscription status, also on platform used. To know what options are available on your specific Checkpoint - run `cpstat` without any switches.
Example of using: `cpstat os -f ifconfig`
status: Work in Progress.
:toc:

View File

@@ -31,8 +31,30 @@ Status: Work in progress.
|*show vpc peer-keepalive*
| Display real-time stats on peering keepalives: last send/receive time, IP of the peer, port and protocol used, vrf for communicaiton.
|*show feature*
|Show enabled features, make sure FEX is on.
|*show fex [_fex-num_] [detail]*
| Show FEX, optionally with details - FEX associated number, state
(Online/Offline/Connecting), model, serial number (of the module). If _detail_,
then also show log of the last registration/offline/online of the FEX.
|*show interface fex*
| In addition to above, show physical interface names (uplinks) where FEX is connected on
Nexus and its state.
|*reload fex _fex-num_*
| Reload the specified FEX (it should be online for this).
|*show inventory fex _fex-num_*
|Show hardware info and serial numbers of the FEX chassis, network module, fans,
power supplies.
|*show environment fex _fex-num_/all*
|Show power consumed, temperature.
|*show int port-channel _n_ fex*
|Show physical interfaces pinned to a given port-channel.
|===

View File

@@ -87,6 +87,25 @@ packets on CLI. It gives definite answers whether a packet reached the
Fortigate, whether it was dropped by firewall rules, what was incoming/outgoing
interface, and contents of the packet if needed.
`verbosity` - level of detail to present, can be one of:
1 - packets' header, includes IP addresses, ports, and flags if set.
2 - packets' header and data for IP packet, i.e. same as above plus contents of
the packet.
3 - same as 2 above plus Ethernet header.
4 - packets' header (no contents) plus incoming/outgoing interface name for each
packet. This gives the indication whether the packet passed the Fortigate or was
dropped by it.
5 - same data as `4` plus contents of IP packets.
6 - packets' header starting from Ethernet plus contents and incoming/outgoing
interface names.
`count` - number of packets to capture, integer. If not set, will be capturing
until the SSH/console timeout or until stopped with `CTRL + C`.
@@ -138,9 +157,21 @@ processes to show with _num-processes_, and use `detail` to get verbose output
|*get hardware memory*
| Show memory statistics: free, cached, swap, shared
|*dia hardware sysinfo conserve*
|Info whether the conserve mode on or off, total memory available, conserve mode
thresholds `red` and `green`
|*execute sensor list*
|List current readings of all sensors present on this model of the Fortigate. Larger models (1500 and up) show CPUs voltage, fan speeds, temperature, power supply voltage and more.
|*dia sys flash list*
|Show contents of the flash memory holding FortiOS firmware images. One of the images
will have `Active` set to `yes`, which means it is the used one.
|*diagnose hardware deviceinfo disk*
|Show all storage attached to the firewall, including disk type, volume, free
space.
|===
@@ -678,6 +709,10 @@ just clear Fortigate DHCP database and will start over allocating again. You can
|Description
|*diagnose firewall auth list*
|List all authenticated and known by firewall usernames. It does not matter what
the source is - LDAP/SSO/etc. Also shows client's IP, idle time, duration.
|*diagnose debug app fnbamd -1*
|Enable debug for authentication daemon, valid for ANY remote authentication - RADIUS, LDAP, TACACS+.