1.3 Gaia OS, clish and expert Mode

What Gaia Is

Gaia is the unified operating system that runs Check Point Quantum Security Gateways and Security Management Servers on supported appliances and open servers. It replaced SecurePlatform and IPSO and is the only supported OS for R82 on Check Point hardware. Gaia is a hardened Linux distribution with a Check Point shell, a web-based Gaia Portal for browser configuration, and a first-boot utility (gaia_startup) that walks through hostname, admin password, interfaces, and routing. CCSA R82 treats Gaia as baseline knowledge — you are expected to know where configuration lives, how to back it up, and how to move between the two shells.

Two Shells: Gaia Clish and Expert Mode

Gaia exposes two shells on the console and SSH:

You move from clish to expert with the expert command and back with exit. There is no default expert-mode password — it must be set before use (in the Gaia Portal under System Management > Expert Password, or via set expert-password in clish). Expert-mode logins are recorded in /var/log/messages, and audit logging can be turned on with set audit login-notifier on so administrator logins are tracked. From expert mode you can still invoke any clish command using clish -c "<command>", which is useful inside scripts.

Common Gaia Clish Commands

The exam expects you to recognize and use these routine clish commands:

show interface                # list interfaces and status
show interface eth0           # detail for one interface
set interface eth0 ipv4-address 10.1.1.1 subnet-length 24
add static-route default nexthop gateway address 10.1.1.254 priority 1
set static-route default nexthop gateway address 10.1.1.254 on
show static-route              # show the routing table
show configuration             # dump the running configuration
save config                    # persist the running config to disk
show version                   # Gaia and Check Point version info
show asset all                 # hardware inventory
show uptime
set hostname gw1
set dns primary 10.1.1.10
set ntp primary 10.1.1.20

Two commands deserve special attention. save config writes the running configuration to /config/conf/ so it survives reboot; without it, changes are lost on the next restart. show configuration dumps the full clish view of the running config and is the fastest way to verify what is actually applied.

Gaia Portal

The Gaia Portal is the browser interface at https://<gateway-or-sms-ip> for routine administration: interface and routing setup, host name and DNS, NTP, administrators, certificates, and software management. Most CCSA-tier tasks can be done from the Portal or clish interchangeably. For R82, the Portal also exposes the CPUSE (Check Point Upgrade Service Engine) tooling for installing Gaia updates, hotfixes, and management upgrades without using the older fwupgrade flow.

Working in Expert Mode

Expert mode is where Check Point-specific troubleshooting lives. Common expert-mode commands you should recognize:

fw stat                        # show loaded policy and interface binding
fw unloadlocal                 # unload policy (emergency troubleshooting)
cpstat fw                      # firewall statistics
cp_conf sic state              # SIC trust state
cpinfo                         # collect diagnostic bundle
cphaprob state                 # ClusterXL state
cpview                         # live performance dashboard
fw monitor -e 'accept;'        # packet capture at firewall inspection points
fw ctl zdebug +drop            # show dropped packets with reasons

Expert mode is also the place to inspect logs that clish does not surface: $CPDIR/log/sic_info.elg for SIC negotiation, /var/log/messages for system events, and $FWDIR/log/ for firewall logs in binary form (read with fw log or SmartView). The exam does not require you to memorize every log path, but it does expect you to know that SIC errors land in sic_info.elg and that cpinfo collects the bundle Check Point support asks for.

Configuration Persistence and Backups

Gaia keeps configuration in two places: the running configuration in memory and the saved configuration under /config/conf/. save config synchronizes them. The show configuration output reflects the running config; show saved-configuration reflects what will load on next boot. Mismatch between the two is a common lab mistake — you set an interface, install a policy, and on reboot the interface change is gone because you forgot save config.

For full-system recovery, Gaia provides snapshot (a tar of the entire system image, restored with giga_snap or via the Gaia Portal) and backup (a structured archive of Gaia config plus Check Point databases). Snapshots are large and used for bare-metal restore on the same hardware; backups are smaller and used to migrate config between Gaia versions or to restore a misconfigured box. Both are covered in detail in chapter seven.

A Common Lab Workflow

A typical first-boot lab flow in a Gaia VM looks like this:

1. Power on the VM and log in to the console as admin.
2. Walk through gaia_startup to set hostname, admin password, and management interface.
3. Open the Gaia Portal, set the expert password, set NTP and DNS.
4. Use CPUSE to install the R82 base product (Security Management or Gateway).
5. From clish, verify with show version, show interface, show static-route.
6. save config and reboot to confirm persistence.
7. From expert mode, run cpinfo once and fw stat after the first policy install.

This workflow exercises every shell, persistence, and the diagnostic commands that show up on the exam. The single most common point-losing mistake is treating clish and expert as interchangeable: clish changes persist with save config; expert-mode Linux changes (like editing files under /etc/) often do not, and on reboot you are back to the saved Gaia configuration.