Checkpoint 156-587 - Check Point Certified Troubleshooting Expert - R81.20 (CCTE)

The Multi-portal Daemon (mpdaemon) is responsible for handling the clientless access connections in Mobile Access VPN. It listens on port 443 and redirects the traffic to the appropriate port of the process that handles the specific connection type, such as cvpnd for SSL Network Extender, MAD for Mobile Access Portal, or HID for HTTPS Inspection.The mpdaemon also performs authentication and authorization for the clientless access connections.References: Check Point Processes and Daemons1, Mobile Access Blade Administration Guide

1: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails= &solutionid=sk97638 : https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_Mobile_Access_AdminGuide/html_frameset.htm

The correct directory where an administrator can find vpn debug log files generated during Site-to-Site VPN troubleshooting is $FWDIR/log/. This directory contains the following files related to vpn debug:

vpnd.elg: This file contains the high-level VPN debug information, such as the VPN tunnel establishment, deletion, and negotiation messages. It can be enabled by using thevpn debug oncommand on the Security Gateway CLI.

legacy_ike.elg: This file contains the low-level IKE debug information for IKEv1, such as the IKE packets, encryption, decryption, and authentication. It can be enabled by using thevpn debug ikeoncommand on the Security Gateway CLI.

legacy_ikev2.xml: This file contains the low-level IKE debug information for IKEv2, such as the IKE packets, encryption, decryption, and authentication. It can be enabled by using thevpn debug ikev2oncommand on the Security Gateway CLI.

These files can be viewed by using thevpn debug viewcommand on the Security Gateway CLI, or by using theIKEViewtool on the Security Management Server GUI.

CPWD (Check Point WatchDog)is the process that monitors, terminates (if necessary), and restarts critical Check Point processes (e.g., FWD, FWM, CPM) when they stop responding or crash.

CPM(Check Point Management process) is a process on the Management Server responsible for the web-based SmartConsole connections, policy installations, etc.

FWD(Firewall Daemon) handles logging and communication functions in the Security Gateway.

FWM(FireWall Management) is an older reference to the management process on the Management Server for older versions.

Therefore, the best answer isCPWD.

Check Point Troubleshooting References

sk97638: Check Point WatchDog (CPWD) process explanation and commands.

R81.20 Administration Guide– Section on CoreXL, Daemons, and CPWD usage.

sk105217: Best Practices – Explains system processes, how to monitor them, and how CPWD is utilized.

 The fw ctl zdebug command is a powerful tool that can be used to collect debug messages from the kernel, clean the buffer, and automatically allocate a 1MB buffer. However, it cannot be used to debug additional modules, such as SecureXL, CoreXL, or VPN. For those modules, other commands or tools are needed, such as fwaccel dbg, fw ctl affinity, or vpn debug.

 The correct command to check the subscription status on the CLI of the gateway is show license status. This command displays the current license information, such as the license type, expiration date, and subscription status for various blades, such as Anti-Bot, Anti-Virus, IPS, etc. The command also shows the contract status for each blade, such as valid, expired, or invalid. If John has renewed his NPTX license, but he gets an error that the contract for Anti-Bot expired, he can use this command to verify the contract status and the subscription status for the Anti-Bot blade.

The other commands are incorrect because:

A. fwm lie print is not a valid command. The correct command is fwm lic print, which displays the license information on the Security Management Server, not on the gateway. This command does not show the subscription status or the contract status for the blades.

B. fw monitor license status is not a valid command. The correct command is fw monitor, which is a tool for capturing network traffic on the gateway, not for checking the license status.

C. cpstat antimalware-f subscription status is not a valid command. The correct command is cpstat antimalware -f subscription_status, which displays the subscription status for the Anti-Virus blade, not for the Anti-Bot blade. This command does not show the contract status for the blade.

The correct Check Point command to display status and statistics information for various Check Point products and applications is cpstat. This command provides a dynamic real-time view of the system, showing the information such as the number of connections, packets, drops, CPU usage, memory usage, disk space, license status, and blade status. The cpstat command can be customized by using various options and flags to specify the product, the interval, the fields, and the format of the output. For example, to display the status and statistics of the firewall module every 5 seconds, the command would be:

cpstat fw -f all -i 5

The other commands are incorrect because:

A. CPview is a Check Point tool that displays information about the system performance, such as the CPU, memory, disk, network, and firewall. It does not show information about other products and applications, such as VPN, Identity Awareness, Anti-Virus, etc.

C. fwstat is not a valid command. The correct command is fw ctl pstat, which displays information about the firewall kernel, such as the number of connections, packets, drops, memory, and synchronization. It does not show information about other products and applications, such as VPN, Identity Awareness, Anti-Virus, etc.

D. CPstat is not a valid command. The correct command is cpstat, which is case-sensitive.

The cpca process is responsible for the generation of certificates on the Security Management Server or the Multi-Domain Security Management Server. It is the Check Point Internal Certificate Authority (ICA) that issues certificates for internal use, such as for VPN, HTTPS Inspection, SmartConsole, and Secure Internal Communication (SIC). The cpca process runs on the Security Management Server or the Multi-Domain Security Management Server as part of the Management High Availability module.