Intro
Suppose, hypothetically, that you had super admin access to a CMA in SmartConsole v 80.40, but lacked ssh or GUI access to firewalls within that CMA? What could you do? Can you run commands in a pinch? Yes. You can. Here are some concrete examples.
Caveats
In the servers section of the domain you can right-click and choose “Run one-time script.” That’s great, but I think there are limits. It will time out a script that takes too long. IDK, maybe 10 seconds or so is the maximum time allowed. The returned text gets truncated if it’s too long. 15 lines of text is OK. 200 is not. Somewhere inbetween those two is the limit.
Running clish commands
clish commands can indeed be run this way. I was interested in examining a few routes on a firewall with many static routes. I ran:
netstat -rn|grep 198.23|head -15
Set a static route
clish -sc “set static-route 197.6.75.0/24 nexthop gateway address 10.23.42.10 on”
Redistribute this route via BGP
clish -sc “set route-redistribution to bgp-as 38002.48928 from static-route 197.6.75.0/24 on”
Run a PING (best to restrict the number of ping packets)
ping -c3 1.1.1.1
Show a part of configuration, e.g., BGP stuff
clish -c “show configuration”|grep bgp|head -15
Show cluster IPs
cphaprob -vs all -a -m if|grep 10.182.136
Learn the name of the switch and switch port an interface is connected to (Cisco switches only)
This is a really awesome trick. And it works. Maybe it relies on something clled CDP. Not sure. But you run it and it will tell you the hostname of the switch and the port, e.g., eth1/5.
tcpdump -vnni eth1-08 -s 1500 -c 1 ‘(ether[12:2]=0x88cc or ether[20:2]=0x2000) and not tcp and not udp and not icmp’
The interface name eth1-08 above is just an example.
Better still, it will even tell you the management IP of the switch! That output will appear like this:
Management Addresses (0x16), value length: 13 bytes: IPv4 (1) 10.122.37.81
This command is general-putpose and works with any device with any OS, assuming you can run a packet trace with tcpdump or equivalent. Very cool.
Conclusion
Real firewall admins I know fail to realize that even when they lack shell access to a firewall they can pretty issue any command they need if they use the one-time script option in SmartConsole. It just helps to follow along the lines of the examples above – limiting output, etc. Even clish config changes can be made! A common reason to be in this situation is to learn someone changed a password or cleaned up old accounts.
As a bonus I show how to identify the name of the switch a firewall is connected to as well as the switch port and management IP of that switch. The general-purpose command works on any OS.