CCTE R81.20 key terms

A diagnostic utility run from the expert shell that collects system configuration, installed hotfixes, kernel parameters, and log excerpts into a compressed archive for support analysis or pre-upgrade baselining.

A real-time monitoring tool that displays CPU, memory, disk, network, and connection statistics on a Security Gateway or Management Server, useful for correlating performance degradation with traffic patterns.

The underlying Linux shell on a Gaia appliance or open server, reached from clish via the expert command, giving access to operating system tools, log files, and scripts not exposed in the Gaia CLI.

The default Gaia command-line interface with hierarchical configuration menus used to set interfaces, routes, DNS, and system settings; it is the primary alternative to the web-based Gaia Portal.

The web interface on port 443 of a Gaia device for configuring network interfaces, routing, administrators, and appliance-level settings, separate from SmartConsole's security management functions.

The Windows client used to manage security policy, objects, gateways, and logs through the Management Server; it replaced the older SmartDashboard interface and organizes work into focused tabs.

The server component that stores the security database, compiles policies, receives logs from gateways, and serves SmartConsole clients; it runs the Check Point services that gateways rely on for policy installation.

A logged-in connection from a SmartConsole client to a Management Server, which can be inspected and terminated from the server side when a client hangs or a lock must be released.

A management account permission profile that allows viewing objects, rules, and logs but blocks edits, useful for auditors or NOC staff who must not change policy.

A named set of allowed management actions assigned to an administrator account, controlling which features such as policy editing, installation, or log viewing the account can use.

The process of compiling the Security Policy into a form the gateway can enforce and delivering it to selected gateways, with per-gateway success or failure reported in SmartConsole.

The enforcement point that inspects and filters traffic according to the installed Security Policy, performs NAT, and sends logs and alerts to the Management Server or a dedicated log server.

A pre-installation check that scans the rule base and object database for problems such as shadowed rules, unreachable objects, or missing interfaces, producing warnings before the policy is pushed.

A rule that can never match traffic because an earlier rule with broader or identical conditions already captures it; it is a common cause of rules that appear correct but never trigger.

The top-to-bottom evaluation sequence in the Security Policy, where the first matching rule decides the action; misordering is a frequent reason traffic is blocked or allowed unexpectedly.

The final cleanup rule that silently drops any traffic not matched by an explicit rule, explaining why traffic with no matching rule produces no log entry unless logging is enabled on it.

A rule written by an administrator with defined source, destination, service, action, and tracking options, as opposed to the automatic cleanup rule generated by the system.

The per-rule setting that controls whether a match is logged, generates an alert, or produces a session record, determining what evidence appears in SmartView or the log file.

A translation rule in the NAT policy that rewrites source or destination addresses and ports for matching traffic; it is evaluated separately from the access rule base and can cause asymmetric routing issues.

A NAT translation generated by the system from object definitions such as translated addresses or hide NAT settings, which can conflict with manually written NAT rules.

A kernel-level packet capture tool on the gateway that shows packets at multiple inspection chain points, revealing where in the chain a packet is dropped or modified.

A labeled stage in the gateway's packet inspection path, such as pre-inbound or post-outbound, where fw monitor can capture traffic to localize where processing changes or discards a packet.

A standard packet capture utility available in expert mode that records raw traffic on an interface, useful when kernel-level tools are unavailable or when comparing capture points across devices.

A command that enables on-demand kernel debug output for selected modules and patterns, letting an engineer trace packet handling decisions without restarting services.

Debug output generated by gateway kernel modules, filtered by module and verbosity, used to trace why a packet is accepted, dropped, or translated during inspection.

The gateway acceleration layer that offloads accepted connections from the slow path to a faster path; packets on the accelerated path may bypass parts of the inspection chain visible to debugging tools.

The command-line utility used to view and manage SecureXL acceleration state, including whether a connection is accelerated and which templates apply to it.

The log analysis component of SmartConsole that lets administrators search, filter, and correlate log entries across gateways, including blocked traffic and security events.

A dedicated or management-hosted service that stores and indexes logs sent by gateways, allowing separate scaling of log retention from policy management.

A command-line tool for querying and exporting log records on a management or log server, useful when SmartConsole access is unavailable or for scripted searches.

A utility that exports log records from a management or log server database into a text format for offline analysis, filtering, or sharing with support.

Secure Internal Communication, the certificate-based trust channel between a gateway and its Management Server; a broken SIC state prevents policy installation and log delivery.

A command-line utility for interacting with the internal certificate authority, used to inspect, revoke, or reinitialize certificates that underpin Secure Internal Communication.

A command that reports which policy is installed on a gateway, the installation timestamp, and whether the gateway's policy differs from what the Management Server expects.

A command that forces a gateway to pull its policy from the Management Server, useful when the gateway missed an installation or the management connection was interrupted.

Commands that stop and start all Check Point services on a device, used during maintenance or to recover from a hung service state, briefly interrupting enforcement and logging.

A full backup of the Gaia system image and configuration that can be reverted to restore a device after a failed upgrade or configuration change.

A structured approach to fault isolation: define the symptom, gather evidence from logs and captures, form a hypothesis, test it at the narrowest point, and confirm the fix.