Command Line Reference
Next Generation Security Gateway Guide R80.20 | 477
fw sam
Description
Manages the Suspicious Activity Monitoring (SAM) rules. You can use the SAM rules to block
connections to and from IP addresses without the need to change or reinstall the Security Policy.
For more information, see sk112061
http://supportcontent.checkpoint.com/solutions?id=sk112061.
You can create the Suspicious Activity Rules in two ways:
• In SmartConsole from Monitoring Results
• In CLI with the fw sam command
Notes:
• VSX Gateway does not support Suspicious Activity Monitoring (SAM) Rules. See sk79700
http://supportcontent.checkpoint.com/solutions?id=sk79700.
• See the fw sam_policy (on page 484) and sam_alert (on page 541).
• SAM rules consume some CPU resources on Security Gateway. We recommend to set an
expiration that gives you time to investigate, but does not affect performance. The best practice
is to keep only the SAM rules that you need. If you confirm that an activity is risky, edit the
Security Policy, educate users, or otherwise handle the risk.
• Logs for enforced SAM rules (configured with the fw sam command) are stored in the
$FWDIR/log/sam.dat file.
By design, the file is purged when the number of stored entries reaches 100,000.
This data log file contains the records of one of these formats:
<
typ
e>,<ac
tio
ns>
,<e
xpi
re>
,<ipad
dr>
<
typ
e>,<ac
tio
ns>
,<e
xpi
re>
,<src>
,<d
st>
,<d
por
t>,
<ip_p>
• SAM Requests are stored in the kernel table sam_requests on the Security Gateway.
• IP Addresses that are blocked by SAM rules, are stored in the kernel table sam_blocked_ips
on the Security Gateway.
• To configure SAM Server settings for a Security Gateway or Cluster:
a) Connect with SmartConsole to the applicable Security Management Server or Domain
Management Server
b) Open the Security Gateway or Cluster object
c) Go to the Other > SAM page.
d) Configure the settings.
e) Click OK.
f) Install the Access Control Policy in this Security Gateway or Cluster object.
Syntax
• To add or cancel a SAM rule according to criteria:
[Expert@HostName:0]# fw [-d] sam [-v] [-s <SAM Server>] [-S <SIC Name of SAM Server>]
[-f <Security Gateway>] [-t <Timeout>] [-l <Log Type>] [-C] [-e <key=val>]+ [-
Criteria
To Next Page