Which of the following inputs is suitable for debugging HTTPS inspection issues?

Question

Options

• Afw debug tls on TDERROR_ALL_ALL=5
• Bfw ctl debug -m fw + conn drop cptls
• Cvpn debug cptls on
• Dfw diag debug tls enable

• A
  3% (2)
• B
  78% (46)
• C
  5% (3)
• D
  14% (8)

Explanation

fw ctl debug -m fw + conn drop cptls is the correct command because it invokes the Check Point kernel debug engine (fw ctl debug), targets the firewall module (-m fw), and enables the conn, drop, and cptls debug flags - the cptls flag specifically traces the Check Point TLS engine responsible for HTTPS inspection. Option A is wrong because TDERROR_ALL_ALL=5 is a debug verbosity syntax used with VPN IKE debugging (e.g., vpn debug ikeon), not HTTPS inspection. Option C is wrong because vpn debug targets the VPN/IPsec subsystem, not the HTTPS inspection engine, even though cptls appears in the syntax. Option D (fw diag debug tls enable) is not a valid Check Point command - fw diag is not the correct utility for enabling TLS inspection traces.

Memory tip: Think "kernel controls TLS" - fw ctl debug is the kernel-level tool, and cptls = CheckPoint TLS. Whenever you see HTTPS/SSL inspection issues, reach for fw ctl debug with cptls, not the VPN debug tools.

No community discussion yet for this question.