topic Re: Deployment failure in GCP - 504 Resource Error, Timeout expired. in Cloud Firewall

Deployment failure in GCP - 504 Resource Error, Timeout expired.

johnnyringo — Wed, 22 Jan 2020 15:33:13 GMT

We're having zero luck deploying the CheckPoint CloudGuard IaaS R80.30 High Availability in our enterprise GCP account. In the GCP Deployment Manager, the deployment hangs for 30 minutes, eventually getting this error:

{"ResourceType":"runtimeconfig.v1beta1.waiter","ResourceErrorCode":"504","ResourceErrorMessage":"Timeout expired."}

I also get the same error if I launch the standalone gateway with External IP requested. As a work-around, I can set the External IP to "None", watch the deployment succeed, then add it later.

I do not have any problems deploying in my personal GCP account, so fairly certain this is a permissions or connectivity issue relating to API calls.

Re: Deployment failure in GCP - 504 Resource Error, Timeout expired.

AyGit — Wed, 21 Apr 2021 15:49:46 GMT

Hi @johnnyringo

Did you solved the issue?

Regards

Re: Deployment failure in GCP - 504 Resource Error, Timeout expired.

johnnyringo — Wed, 21 Apr 2021 17:22:28 GMT

Yes, It was due to our Compute Engine default service account being disabled, which had been recommended by our Google onboarding team. The account also needs permission to create external IP addresses. Here we are 1 year and I don't think CheckPoint ever mentions this requirement in their documentation, so I wrote a blog post:

Deploying CheckPoint CloudGuard IaaS High Availability in GCP

Re: Deployment failure in GCP - 504 Resource Error, Timeout expired.

AyGit — Thu, 22 Apr 2021 17:19:44 GMT

The default service account is already enabled

and we have also the permission to create external addresses (I can view both IP address in GCP > VPC Network > External IP addresses).

We deployed again the template in GCP and are facing with the same message error.

Re: Deployment failure in GCP - 504 Resource Error, Timeout expired.

johnnyringo — Thu, 22 Apr 2021 20:40:52 GMT

There's many things that can cause this. Another requirement is that "Private google access" must be enabled for all relevant subnets, although I think there's a more descriptive error message if it fails for that reason.

You can of course open a support case with CheckPoint, but honestly our support experiences with the GCP projects have been horrible. Our Google SE ultimately proved to be much more helpful than CheckPoint in diagnosing the problem by looking at logs on their end, although I didn't catch exactly where he was looking.

I do know the template itself is OK, because I successfully deployed a fresh R80.30 and R80.40 BYOL clusters this morning.

Re: Deployment failure in GCP - 504 Resource Error, Timeout expired.

AyGit — Thu, 22 Apr 2021 20:53:47 GMT

‘Privâtes Google access’ is well configured ...

I’ve deployed the template in my personal environment too and it works good.

We’ll go in deep in the gcp logs