How to configure Check Point software to upload data to Check Point / download data from Check Point in versions R81.10 and lower

Solution

Note - For Management Server versions R81.20 and higher, see sk175504.

Table of Contents:

1. Consent flags

2. How consent flags are enabled

3. Flags Decision Table

   • For Security Management Servers / Domain Management Servers / Log Server (all versions)
   • For R77.X / R76SP.X Security Gateways managed by R77.X Security Management Servers
   • For R77.X / R80.X Security Gateways managed by R80.X Security Management Servers

4. How consent flags are modified

5. Related solutions

6. Revision History

(1) Consent flags

Note - For Quantum Spark appliances, refer to the CLI command "set privacy-settings" in the R81.10.X CLI Reference Guide.

Important Note: On a Security Gateway, the value of flags is changed automatically during policy installation - after setting the relevant flags on the Security Management Server / Domain Management Server (either using SmartConsole / SmartDashboard, or using Database Tool (GuiDBedit Tool) / dbedit tool).

Notes:

• The consent flags are stored on the Gaia OS in the following places:

• The "Allow Upload" consent flag has priority over the "Sync with User Center" consent flag (refer to sk94064).

Meaning that if administrator enabled the "Sync with User Center" consent flag, but did not enable the "Allow Upload" consent flag, then synchronization with User Center will not be performed.

• In R77.X and lower, the consent flags on a Security Gateway are independent of the consent flags on a Security Management Server.

Meaning that, for example, if administrator enabled the "Allow Upload" consent flag on an R77.X Security Gateway, but disabled the "Allow Upload" consent flag on an R77.X Security Management Server, then the Security Gateway would still be able to upload the data to Check Point.

Starting in R80, the consent flags on an R80.X Security Management Server have priority over the consent flags on an R77.X / R80.X Security Gateway.

For details, refer to "Flags Decision Table" section below.

Important Notes:

• To completely block the upload of data from a Security Management Server / Multi-Domain Security Management Server / Domain Management Server / Multi-Domain Log Server / Domain Log Server / Log Server / SmartEvent Server to Check Point cloud, the administrator must:

1. Disable the consent flags in the Objects Database (either using SmartConsole / SmartDashboard, or using Database Tool (GuiDBedit Tool) / dbedit tool)
2. Perform "Install Database" operation
3. Disable the consent flag in the Gaia OS Database

• To completely block the upload of data from a Security Gateway to Check Point cloud, the administrator must:

1. Disable the consent flags in the Objects Database (either using SmartConsole / SmartDashboard, or using Database Tool (GuiDBedit Tool) / dbedit tool)
2. Perform "Install Policy" operation
3. Disable the consent flag in the Gaia OS Database

(2) How consent flags are enabled

Consent flags are enabled during the initial installation and database installation / policy installation.

• The Gaia First Time Configuration Wizard creates the consent flags in the following way:

• The "Install Policy" operation:

  • Creates the "Allow Upload" and "Allow Download" consent flags in the Objects Database (in the $FWDIR/conf/objects_5_0.C file) on all configurations (Security Gateway, Management Server, and so on).

• Creates the "Allow Upload" and "Allow Download" consent flags in the Registry (in the $CPDIR/registry/HKLM_registry.data file) on a Security Gateway.

• Creates the "Allow Upload" and "Allow Download" consent flags in the Internal Database (in the $CPDIR/tmp/umis_objects.C file) on a Security Gateway.

• The "Install Database" operation on a Management Server / Domain Log Server / Log Server / SmartEvent Server object:

  • Creates the "Allow Upload" and "Allow Download" consent flags in the Internal Database (in the $CPDIR/tmp/umis_objects.C file) on a Security Management Server / Multi-Domain Security Management Server / Domain Security Management Server / Multi-Domain Log Server / Domain Log Server / Log Server / SmartEvent Server.

• Gaia Portal or Gaia Clish

In the R80.40 and higher versions, you can control the " Upload Core Dumps" consent flag:

• In Gaia Portal:
  1. In the navigation tree, click System Management > Core Dumps.

2. Select or clear the option " Send crash data which might contain personal data to Check Point"

3. Click Apply.

• In Gaia Clish:
  1. Run:

set core-dump send_crash_data {on | off}

2. Run:

save config

During upgrade:

• No change is made to these flags.

• After the upgrade is completed, flags can be modified as described in the "How consent flags are modified" section below.

(3) Flags Decision Table

The following tables show possible combinations of flags values and whether the Gaia OS can download data from / upload data to Check Point.

Note: The ability to download / upload is controlled separately by the corresponding flags. Refer to "How consent flags are modified" section below.

(4) How consent flags are modified

Important Notes:

• On a Security Gateway, the value of flags is changed automatically during policy installation - after setting the relevant flags on a Security Management Server / Domain Management Server (either using SmartConsole / SmartDashboard, or using Database Tool (GuiDBedit Tool) / dbedit tool).

• On a Multi-Domain Security Management Server, you must configure the applicable value for the consent flags also in the Global Domain (in addition to the applicable Domain Management Servers).

• On a Multi-Domain Log Server, you must configure the applicable value for the consent flags also in the Global Domain (in addition to the applicable Domain Log Servers).

Instructions:

Use the following CLI commands:

• In R80.X versions - the "cpprod_util" command:

• In R77.X versions - the "ckp_regedit" command:

(5) Related solutions

• sk94508 - Recommended Internet Access Settings for Automatic Downloads
• sk94509 - Recommended Internet Access Settings for Uploading Data
• sk106251 - How to configure Security Gateway to accept its traffic only to Check Point online services
• sk92739 - The CPinfo utility

(6) Revision History