Which firewall daemon is responsible for the FW CLI commands?

The fwd daemon is the primary firewall worker process on Check Point gateways and handles FW CLI commands such as fw stat, fw ctl, and fw monitor. It manages policy enforcement at the kernel level and processes all enforcement-related command-line interactions issued by administrators on the gateway.

fwm is the Firewall Management daemon that handles communication between the management server and the gateway for policy installation and logging, not FW CLI commands.

cpm is the Check Point Management daemon introduced in R80 to handle management API operations and SmartConsole sessions on the management server, not firewall CLI commands on the gateway.

cpd is the Check Point general daemon responsible for policy distribution and inter-process communication between Check Point components, not for processing FW CLI commands.