Command Line Reference
Next Generation Security Gateway Guide R80.20 | 313
comp_init_policy
Description
Generates, loads, or removes the Initial Policy on a Security Gateway, or a Cluster Member.
Until the Security Gateway or cluster administrator installs the user-defined Security Policy on the
Security Gateway or Cluster Members for the first time, security is enforced by an Initial Policy.
The Initial Policy operates by adding "implied rules" to the Default Filter. These rules forbid most
of the communication, but allow the communication needed for the installation of the Security
Policy.
The Initial Policy also protects a Security Gateway or Cluster Members in these cases:
• During Check Point product upgrades
• When a SIC certificate is reset on the Security Gateway or Cluster Member
• When Check Point product license expires
The Initial Policy is enforced until a policy is installed, and is never loaded again. In subsequent
boots, the regular policy is loaded immediately after the Default Filter.
Notes:
• The Initial Policy overwrites the user-defined policy.
• Output of the cpstat -f policy fw command shows the name of this policy as
InitialPolicy.
• Security Gateway, or Cluster Member stores the installed Access Control Policy in these
directories:
• $FWDIR/state/__tmp/FW1/
• $FWDIR/state/local/FW1/
• $FWDIR/state/<
Name of Cluster Object
>/FW1/
Also refer to these commands:
• control_bootsec (on page 317)
• fwboot bootconf (on page 523)
• fw defaultgen (on page 436)
• fwboot default (on page 533)
Syntax
[Expert@HostName:0]# $FWDIR/bin/comp_init_policy [-u | -U]
[Expert@HostName:0]# $FWDIR/bin/comp_init_policy [-g | -G]
Parameters
Parameter Description
No
Parameters
The command runs with the last used parameter.
To Next Page