Dissecting Object Filler and Object Dumper

1. Dissecting Object Filler and Object Dumper Martín Hoz martinhoz@gmail.com CPUG CONEurope - SwitzerlandSeptember 8th, 2009

2. Who am I? • MartínHumberto Hoz Salvador • Electronics and Communications Engineer. • UANL – México • Interested on Internet Security since ~1993. • Been using Check Point products since 1998 (3.0b/4.0) . • CCSE 4.1 – CCSE NGX R60 • Check Point employee for ~6 years (2001-2007). • Wrote Object Filler / Object Dumper (2003-2006). • Native Language: Spanish.

3. Whereis México?

4. Someexpectations • Youalreadyknowthebasicson Internet Security • IP Addressing, routing • YoualreadyknowthebasicsonCheck Point • Creatingobjects and rules • Savingconfigurations • Youknow a bit of SPLAT / Windows / … • Yougetintothecommand line • You are ableto transfer files over FTP 

5. Somecomments and warnings • My Check Point knowledgestopson NGX R65 • I have NOT testedthetoolson NGX R70 • I testediton NGX R65 and allworks, withexception of Connectraobjects • My motivationsfordoingthistalk: • Fullyexplainwhatthetools can do and cannot do beforethey die… • Explainwhy and howthetools are designed • Have a final chance toanswerquestions

6. Agenda • Introduction • Motivationsondesigningthetool • ObjectFiller – objects, files and othervendors • ObjectDumper – dumping and recovering • Interestingoperations • Provider-1 – considerations • Conclusions – and thefuture…

7. Object Management Basics • Objects and rules are created primarily trough SmartDashboard (GUI) • Good for day-to-day administration • Not too easy for massive loads, like new configs • Objects have different properties according to their type • Groups have members • Gateways have interfaces • Networks have netmasks • Hosts can be “servers” for DNS, Web or Mail • Rules have predefined properties, the same for every type of rule • Desktop Security, QoS, NAT and Security rules are different types of rules

8. Where’s this stuff stored? • Most valuable configuration information is stored under $FWDIR/conf/ (or %FWDIR%\conf in MS Windows) • Objects are primarily placed under objects_5_0.C • Rules are stored under rulebases_5_0.C • Both are ASCII files

9. However… • The files are in text, but using a special format • Which is *very* sensitive • Manual changes in these files can trigger severe problems • The general rule is: Don’t do it • Unless you really know what you are doing and you have CP Support backing you • Specially because there is a supported way to make changes…

10. DBedit

11. DBedit • SupportedCommand line tool that allows changes in the overall configuration • Therefore, allows changes in the objects_5_0.C and rulebases_5_0.C • Allows and extends what can be done from the SmartDashboard • Present in all NG and NGX versions • All the operating systems supported by Check Point SmartCenters • Known to have better behavior since NG FP3 • As all the CLIs, there’s a special syntax that has to be used. This is documented by Check Point • Nowadays, manuals and Knowledge Base entries have information on it • DBedit is scriptable • It can take commands from a file…

12. DBedit invocation

13. DBedit invocation • Preferably use it from the SmartCenter you’re going to operate. This is, use localhost • If you are using it form a different machine, then the IP address you’re using has to be declared as a valid GUI • Use the credentials of a regular R/W administrator • dbedit without options • dbedit with all options

14. Doing a basic operation • Creating a basic host • Changing color and adding NAT…

15. So, DBedit… • Is really powerful, but could be a bit complex • The syntax is as well very sensitive to spaces, colons, dots, etc. • If you want to write a script, you’ve to spend some time: • Learning the DBedit syntax (useful then and forever) • Writing a (Shell/Perl/etc.) script to generate the DBedit Script from a more easier syntax, such as a CSV or XML file • Or type/edit the DBedit script file by yourself • That sums up easily a couple of hours • Writing something you will use only once most of the times

16. Other Scenarios: What if… • You’ve to do massive operations • You have to create 256 networks for 10.10.0.0/16 • 10.10.1.0/24, 10.10.2.0/24, 10.10.3.0/24, and so on… • You have a list with 400 hosts objects with employee names and IP addresses which you need to enter to SmartCenter • Add NAT to a group of objects that are already created

17. Other Scenarios: What if… (2) • Or a bit more complicated: Migrating from Cisco PIX or NetScreen/Juniper to Check Point… • … and there’s a customer that has 300 objects plus 900 rules on it. • In all those cases, takes lots of time analyzing and/or typing

18. Agenda • Introduction • Motivationsondesigningthetool • ObjectFiller – objects, files and othervendors • ObjectDumper – dumping and recovering • Interestingoperations • Provider-1 – considerations • Conclusions – and thefuture…

19. Whatdrovethetoolcreation? • Threelargeconfigconversionsfrom PIX in a row… • Two times of setting up 200+ objectsfor a PoC • Once helping a friendtoadd NAT configtohisobjects

20. Aboutofiller/odumperdesign • Thetoolhadtobeuseful and solvetheproblem: easethetask of populatingtheSmartCenter. • Thetoolhadtowork! (or I wouldbe in bigtroublewith my friends/customers) • I usedtheonlylanguage I knew and had a compilerfor… • Not Perl

21. More notes (ortheadvantages of an “unsupportedtool”) • I wantedtoworkwith a “human-readable” format: ASCII Textseems fine to me • Readstext, writestext: You can modifyanythingyouneed • Yourchanges do notaffectyourconfigurationnecessarily • You can work offline • No latencies • You can takeworkto a plane • Youdon’tdependontheCheck Point software tobe “up and running” (especiallyusefuloncrashes) • Multiplatform and independant • As itis a standard C file, no dependenciestolibraries • You can runiton Windows, Solaris and GNU/Linux (thatincludes SPLAT)

22. Someother notes • Thetoolwas NOT supposedtobesharedwithanybodybut my friends • Thetoolwas NOT thoughtonbeing extensible, upgradable, maintainableorscalable… • And so ObjectFillerwasborn. ObjectDumperjustcame a couple of yearslater • Whenpeoplebeganto use it, documentationbecame a priority. I estimate I spentalmost 50% of the time devotedtodocumentation…

23. A recentsuccessstory • http://www.networksandsecurity.com/home/2009/08/24/recovering-from-a-dead-check-point-smartcenter/ • “Recovering from a dead Check Point SmartCenter” says it all

24. Agenda • Introduction • Motivationsondesigningthetool • ObjectFiller – objects, files and othervendors • ObjectDumper – dumping and recovering • Interestingoperations • Provider-1 – considerations • Conclusions – and thefuture…

25. What is Object Filler? • To begin with, it is a FREE but unsupportedand unofficial tool • Automates the DBedit script creation to feed SmartCenter’sdbedit • Works mainly with Network/Service Objects • It works as well with firewall (security) rules • Can take information from 3 different type of feeds • Command Line • Useful when creating consecutive objects: nets, hosts within a given range, etc. • Predefined file with objects information • CSV File (predefined format), Hosts File (UN*X, Windows), … • Configuration from a third-party vendor configuration file • Cisco PIX and Cisco Routers (ACLs), NetScreen, Gauntlet, SideWinder, Raptor

26. ObjectFiller Spreadsheet / Text Editor Command Line Arguments CSV File objects Text PredefinedFile (CSV, etc.) Object Filler objects, rules DBedit commands objects, rules Third-partyconfigfile Check Point SmartCenter DBEditFile

27. SupportedbyObjectFiller / Dumper • Network Objects • Services • Firewall rules • Carefulwithresources and authentication! • Itdoes NOT Support usersorgroups • Theyhave a differentdatabase Reference: Pages 25-27 ontheUser’s Manual containtablesforallsupportedobjects

28. ObjectsSupported

29. Resources, Services and Operationssupported

30. Creating objects from Command Line • ofiller -t net -s 192.168.0.0 -d 192.168.255.0 -m 24 -c green -onetworks.txt • For producing a CSV file, try: ofiller -t net -s 192.168.0.0 -d 192.168.255.0 -m 24 -c green -a networks.csv

31. The resulting (-o) text file contents

32. Importing the results into SmartCenter • Pass the file to the SmartCenter • Use FTP (ASCII file type), copy-paste, etc. • Use DBedit with the file as the input file • Make sure no GUI is running with R/W permissions

33. The results in the database after before • The objects are now created in the Objects Database • In less than 5 minutes • You should be able to see them within the SmartDashboard • You may create a new Database Revision Control entry before and/or after the objects creation, as a “backup”

34. Anotherexample: • Thetask “Usingtheaddressspace 10.10.0.0/16, createallthenetworksthat can have a 22 bit netmask (255.255.252.0) and HideNAT’embehindthe IP addresses 172.16.10.10-15” • Thecommand line: ofiller -t net -s 10.10.0.0 -d 10.10.255.255 -m 22 -c blue -ns 172.16.10.10 -nd 172.16.10.15 -nm 24 -a with_nats.csv

35. Theresult: CSV

36. Theresult: DBEdit

37. Theresult: SmartDashboard

38. Other sources for importing objects • Comma Separated Values (CSV) files • Created usually with an spreadsheet (MS Excel is an option), with values fixed according to the column • The most powerful way to import objects • Represents object and Firewall rules • That’s the format Object Dumperuses • Uses the program with Options –f and –ilist • Format is documented on the Manual • Section 11.2 Comma Separated Values (CSV) file type • Pages 35-45

39. Sample CSV File for objects

40. Sample CSV File for groups

41. Sample CSV File for services

42. Sample CSV File for firewall rules

43. Somespecialtips • When copying multiple objects, disable verifications: • “-nopv” will disable internal verifications, allowing you to copy duplicates • When handling policies • You must use the “-p” switch on object filler to specify a policy name. • Otherwise, rules WILL NOT be processed, even if they are on the CSV file • Policy Name should NOT exist, or it will overwrite it! • You may need to create a “Policy Package” with the same name • Make sure you use “-nopv” to avoid issues, if some of the objects were not processed on “this run”.

44. Other source files supported • Lists Files (a “less-complex” CSV) • Files contain just IP addresses and netmasks • Object Filler creates the names and the type of object according to the IP address and netmask. • Uses the program with Options –f and –ilist

45. Other source files supported • Hosts • A regular Hosts file. The ones found at /etc/hosts in UN*X or %SYSTEMROOT%\system32\drivers\etc in Windows • Uses the program with Options –f and –ihosts

46. Importing from Other Brands • Object Filler supports importing Network Objects from configurations of other brands • Object Filler parses the configuration file, and when detects some valid IP address and netmask, builds an object according to such data. • Rules support is here as well • Importing ACL Rules from Cisco PIX and Cisco Routers

47. Importing from Other Brands • As of Object Filler 2.4 it is “supported” • Cisco PIX and Cisco Routers • Network Objects, Groups, NAT, Services and Rules • NetScreen/Juniper • Network Objects, Static NAT • Gauntlet • Network Objects • SideWinder • Network Objects, Groups, Services • Raptor • Network Objects

48. Converting from Cisco PIX to Check Point Example

49. Source PIX configuration (part of it)

50. Translating just Network Objects (Preview mode – using –a to get a CSV file)