CCTE R81.20 flashcards
CCTE R81.20 · Build recall with a focused review session.
31 cards. Read the term and the definition here. The deck at the top of this page is optional.
- cpinfo purpose
- Collects OS details, product versions, installed policy state, and configuration into a single file for support escalation and version comparison.
- cpwd_admin list
- Displays each daemon's process state and restart count. Repeated EXITED entries indicate a crash loop rather than a configuration problem.
- fw stat output
- Shows the installed policy name and installation timestamp per target. A mismatch with SmartConsole status signals a partial or failed install.
- zdebug persistence
- fw ctl zdebug output is not written to disk. Pipe it to tee to capture, and stop the debug with a minus flag when finished.
- cpstat usage
- Reads live daemon and blade status from a Gateway, such as OS, firewall, and per-blade counters, before any restart is attempted.
- Symptom scope triage
- Determine whether a failure affects one client, one subnet, or all users. The scope narrows the fault to a host, a routing segment, or a Gateway-wide cause.
- Debug escalation ladder
- Start with logs and counters, then fw ctl debug for kernel inspection, then per-blade debug flags. Each level is more disruptive than the last.
- Change rollback baseline
- Capture cpinfo, the active policy name, and fw stat output before changes. These artifacts define the exact state to restore on rollback.
- Management daemon roles
- cpm runs the main management process, cpd supervises daemons and the API, fwm handles legacy policy and object work, and postgres stores data.
- api status command
- Reports whether the Management API server is running. When down, SmartConsole views and revision operations that depend on the API fail.
- Revision revert scope
- Reverting to a revision restores Management object and policy state only. It does not roll back the policy already installed on Gateways.
- fwm.elg log
- Records management-side policy and object operations. Login and install failures rooted in Management are diagnosed here first.
- cpd.elg log
- Records daemon supervision events, SIC-related activity, and API startup. Certificate and trust failures appear in this file.
- Targeted daemon restart
- Use cpwd_admin stop and start for a single daemon instead of cpstop and cpstart, which interrupts all connected GUI and API sessions.
- MDS versus domain objects
- Multi-Domain Server objects and per-domain objects are separate scopes. A global change requires install to the Domain Management Server, not the MDS.
- dbedit object editing
- Edits objects through validated interfaces so revision tracking and schema checks apply. Hand-editing underlying database tables is unsupported and risks corruption.
- Policy install chain
- Policy compiles on Management, transfers to the Gateway, is verified, then installed by the fw process. Failure at any step leaves the prior policy active.
- SIC failure symptoms
- Secure Internal Communication problems appear as cpd down, cpstart errors, or "SIC status not initialized" during policy install. Check cpd.elg for details.
- Blade activation requirement
- Enabling a Software Blade does not take effect until a policy install completes. Blade status appears in cpstat only after that install.
- Cluster member states
- A cluster member in Ready but not Active state does not forward traffic. Verify with cphaprob stat before investigating policy causes.
- cphaprob list
- Enumerates cluster and Gateway critical processes. A failing critical process triggers failover in High Availability clusters.
- Rule shadowing
- An earlier drop or block rule overrides later accept rules. Confirm which rule matched using the log record's rule number and hit counts.
- fw fetch versus install
- fw fetch pulls policy to the Gateway manually. fw stat then confirms the new policy name is active before assuming the change applied.
- NAT and policy sync
- A standard policy install pushes both policy and NAT. Manual fw operations can leave NAT out of sync with the installed rulebase.
- fw monitor four points
- Captures at i inbound pre-inspection, I inbound post-chain, o outbound pre-chain, and O outbound post-inspection. The vanishing point localizes the drop.
- fw monitor filter syntax
- Capture-time filters such as accept host(10.0.0.1) and port(443) limit output. Unfiltered capture on busy Gateways is unreadable and slows inspection.
- tcpdump versus fw monitor
- tcpdump sees the interface before inspection; fw monitor sees the kernel inspection path. A packet in tcpdump but not fw monitor indicates a pre-inspection drop.
- Anti-spoofing drop
- Logged as address spoofing. Verify the topology object's interface leads and the routing table before altering topology settings.
- fwm logexport
- Converts binary log records to text for offline analysis and grep-style searching across large log sets exported from a Log Server.
- Log server unreachable
- The Gateway buffers logs locally when the Log Server is unreachable. Check fwd.elg and Log Server SIC before concluding an event was not logged.
- SecureXL fast path
- Accelerated packets may bypass fw monitor capture. Temporarily disable acceleration with fwaccel off to force traffic onto the slow inspection path.