156-582 Check Point Certified Troubleshooting Administrator - R81.20 (CCTA) Practice Questions

The cpinfo command is the standard Check Point utility for gathering a wide range of configuration, log, and diagnostic information from a system. The output file generated by cpinfo is what Check Point support typically requests to begin troubleshooting a case.

True. The vpn tu command starts the TunnelUtil shell, which provides a menu-driven interface for managing VPN tunnels and SAs. From this shell, an administrator can list current SAs and delete specific ones for a peer gateway. This is a common troubleshooting step to force a complete re-negotiation of a problematic VPN tunnel without impacting other tunnels or restarting the entire vpnd process.

The fwk process is a generic worker process used by many of the user-space Software Blades. When traffic needs to be inspected by blades like Application Control, URL Filtering, or Anti-Virus, the kernel passes the connection to a fwk process for detailed inspection. High memory usage in fwk often points to an issue or heavy load within one of these blades.

The cphaprob stat command is the standard utility for checking the status of a ClusterXL cluster. It provides a concise summary of the cluster's state, including the status of the local member, the peer member, and the status of configured pnotes (problem notifications). This is the quickest way to determine the active/standby status of cluster members.

The $CPDIR/database/certs_db directory contains the certificate files that the gateway uses to validate the authenticity of Check Point's download servers for blade updates (like Application Control, IPS, Anti-Virus). If these certificates are missing, corrupt, or outdated, the TLS handshake with the update servers will fail, preventing downloads. This is a key location to check for advanced update troubleshooting.

The PSL Reject: ASPI_REF_NOT_FOUND message is indicative of a drop decision made by a user-space process. The kernel's Passive Streaming Library (PSL) hands over the connection to a blade (e.g., Application Control, IPS) for inspection. The blade then makes a decision and informs the kernel to drop the packet. This specific error means the reference to the connection in the user-space daemon could not be found, often because the daemon decided to block the connection. This points the investigation towards the software blades, not the core firewall rulebase or state table issues.

The command fw ctl debug -m IPS + all enables the most comprehensive debug flags specifically for the IPS module. This will provide granular details in the kernel debug output (fw ctl kdebug) about IPS inspection, including which specific protection is being triggered and why. fw ctl zdebug drop is useful for seeing drops but may not specify which IPS protection caused it. fw monitor shows packet flow but lacks the internal processing details of the IPS blade. vpn debug is irrelevant as the tunnel itself is stable.

For an outbound connection, Hide NAT (source NAT) occurs on the outbound chain of the firewall kernel. The 'o' (pre-outbound) inspection point shows the packet before it leaves the firewall kernel's internal processing, still with its original source IP. The 'O' (post-outbound) inspection point shows the packet after all outbound processing, including NAT, has been completed and just before it is sent out the physical interface. Therefore, 'O' is the first point where the translated source IP will be visible.