Let cisco switch use 3rd party SFPs

Cisco SFP 
Left side = transmit
Right side = Recieve
http://www.cisco.com/c/en/us/td/docs/interfaces_modules/transceiver_modules/installation/note/78_15160.html


Commands to allow using non Cisco SFPs
service unsupported-transceiver
no errdisable detect cause gbic-invalid


taken from:
http://www.firewall.cx/cisco-technical-knowledgebase/cisco-switches/866-cisco-switches-3rd-party-sfp.html

Check your sfp
sh int gigabitEthernet 0/3 status 
sh int gigabitEthernet 0/3 capabilities (check type)

VPN uptime

See how long a VPN is up
show vpn-sessiondb l2l filter name x.x.x.x

see what port ASDM is running on

You can port scan the firewall or

sh run | i http server enable

add a route on checkpoint CLI

route add -net 10.5.140.0/24 gw 192.168.0.1 (works for lgma need write mode on FW you are adding the route on open the correct policy for each fw before making the change)

Remove a route worked on PH
route del -net 192.168.80.0/20 gw 192.168.80.51


route add -net 192.168.80.0/20 dev eth15
gives this kind of route
192.168.80.0    0.0.0.0         255.255.240.0   U         0 0          0 eth15

Maybe this in newer versions
https://supportcenter.checkpoint.com/supportcenter/portal%3FeventSubmit_doGoviewsolutiondetails%3D%26solutionid%3Dsk39746

clish (enter clish if no already there)

set static-route 192.168.0.0/24 nexthop gateway address 10.0.0.1 priority 1 on

save config

exit

netstat -nr | grep 192.168.0.0

Run on both FWs

(works on REV fws)

*** If you get a cloning mode error enter the CLISH command with a space in front of it, don't ask me how that works

Watch out for NAT's you may need to add to grp_No_NAT

There may be a static server NAT for the server.

Show routes
netstat -nr - show all routes

netstat -nr | grep 10.5.140

185.5.241.204

Use nslookup to find the IP addresses of the domain controllers

You can use Nslookup is a command-line tool that displays information you can use to diagnose Domain Name System (DNS) infrastructure.

1. Click Start, and then click Run.
2. In the Open box, type cmd.
3. Type nslookup, and then press ENTER.
4. Type set type=all, and then press ENTER.
5. Type _ldap._tcp.dc._msdcs.

run ASA web interface on another port

ASDM 

ASA(config)#http server enable 8080

https://192.168.1.1:8080

WebVPN

ASA(config)#webvpn
ASA(config-webvpn)#enable outside
ASA(config-webvpn)#port 65010

https://192.168.1.1:65010 

https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-device-manager/118842-technote-asdm-00.html 

You also need to allow it under the ASDM config
http server enable 8080
http pub.pub.pub.pub 255.255.255.255 outside
http prv.prv.prv.prv 255.255.255.0 inside

Same for SSHssh pub.pub.pub.pub 255.255.255.255 outsides

ssh prv.prv.prv.prv 255.255.255.0 inside

Don't forget crypto key generate 

same network in use on both sides of the VPN

Often small businesses will use a 10.0.0.0/8, 192.168.0.0 /16 etc as they don't know what to fill in.


====SIDE A====
object network REAL-LOCAL-A-NET
subnet 192.168.1.0 255.255.255.0

object network MAPPED-LOCAL-A-NET
subnet 172.18.19.0 255.255.255.0

object network MAPPED-REMOTE-B-NET
subnet 172.18.20.0 255.255.255.0

nat (inside,outside) source static REAL-LOCAL-A-NET MAPPED-LOCAL-A-NET destination static MAPPED-REMOTE-B-NET MAPPED-REMOTE-B-NET

access-list VPN-ACL permit ip object MAPPED-LOCAL-A-NET object MAPPED-REMOTE-B-NET


===SIDE B====

object network REAL-LOCAL-B-NET
subnet 192.168.1.0 255.255.255.0

object network MAPPED-LOCAL-B-NET
subnet 172.18.20.0 255.255.255.0

object network MAPPED-REMOTE-A-NET
subnet 172.18.19.0 255.255.255.0

nat (inside,outside) source static REAL-LOCAL-B-NET MAPPED-LOCAL-B-NET destination static MAPPED-REMOTE-A-NET MAPPED-REMOTE-A-NET