Semi-Automatic Data Collection

Download the data collection script:

Semi-automatic data collection procedures

Full instructions for running the data collection scripts can be found in the AlgoSec Firewall Analyzer's User Guide.
Quick-start instructions appear below:

• Check Point - Non-Windows

(Sun Solaris, Linux,SecurePlatform, Nortel Alteon or Nokia IPSO)

Step 1 - Preparation
The ckp_collect script needs to run on the Check Point Firewall-1 management station. It also uses Check Pointi's OPSEC commands on the management station to extract the routing table from the Check Point enforcement module.

Step 2 (Optional, AFA v5.0 or above) - Run log collection script
In order to include log analysis in the report, you will need to manually collect the logs as well. This step is optional.
Login to the relevant log server as root (can be the SmartCenter or CMA).
Run the script ckp_log_collect, and answer the questions. Log collection may take some time.
An archive with the logs will be created.

Copy the generated archive to the relevant SmartCenter/PV-1 (where the ckp_collect script is), and proceed to Step 3.

Step 3 - Run collection script
Login to the management module as root (or a user that has access to the Check Point files). If you use Provider-1, type:
        ckp_collect -p
    Otherwise, type:
        ckp_collect

The script will take you through a question-and-answer session, and will collect the necessary files and routing table. An archive file called ckp-〈firewallname〉-〈date〉.tar is created: this is the file you need to transfer to the AFA machine for analysis.

Step 4 - Automate the data collection using your stored profile
At the end of the data collection session, the script will ask you if you wish to store your answers in a profile, and will let you choose a name for your profile.
Note: your SSH password is not stored in the profile.

Once you have a stored profile, you may use it to streamline the collection process. Assume you have a profile named "myfw".

Login to the management module as root (or a user that has access to the Check Point files). Then type:
        ckp_collect myfw
The script will use the answers you provided when you created the "myfw" profile (except your ssh password).

Type "ckp_collect -h" for a summary of activation switches and options.

Full instructions for running the data collection scripts can be found in the AlgoSec Firewall Analyzer's User Guide (pdf).

Step 5 - Verify your topology
If your firewall is internal, or connected to a business partner, or to a DMZ press here.

• Check Point Firewall-1 - Windows

Step 1 - Run collection script
If your Check Point Firewall-1 management station uses Windows NT/2000/XP, you need to use the ckp_collect.bat batch file. To run the script type:

         ckp_collect /remote filter-module-IP-address

where "filter-module-IP-address" is the IP address of one of the modules managed by this management station. An archive file called C:\Algosec\ckp_collect\ckp_collect.tar.gz is created. This is the file you need to copy to the AlgoSec Firewall Analyzer machine.

Step 2 - Verify your topology
If your firewall is internal, or connected to a business partner, or to a DMZ press here.

• Cisco router access-control list (IOS)

Step 1 - Run collection script
Run the routerdump.pl collection script to create a file named routername-, followed by the creation date.

• Juniper Netscreen

Step 1 - Manually collect the Netscreen configuration file
Use the Juniper Netscreen web interface to collect a Netscreen configuration file manually:

Use your browser to connect to the Netscreen firewall, and using the navigation bar on the left select Configuration→Update→Config File:
Click on the "Save To File" button.
When prompted, save the file with an extension of ".nsc", such as "myNetscreen.nsc".
Copy the ".nsc" file to the AlgoSec Firewall Analyzer machine, and analyze it using the File→Analyze from file menu,
or proceed to the next step to include log analysis as well)

Step 2 (Optional, AFA v5.0 or above)
Login to the NSM Dev server as root.
Run the nsm_log_collect script and answer the questions. Log collection may take some time.
An archive with the logs will be created.

Create a single archive (zip or tar) containing the generated logs archive, and the config file from Step 1.
Analyze the archive in the AlgoSec Firewall Analyzer.