topic AWS Gateway Load Balancer Auto Scaling Group upgrade user data script issue in Cloud Firewall

AWS Gateway Load Balancer Auto Scaling Group upgrade user data script issue

ajsingh — Tue, 12 Nov 2024 23:17:11 GMT

Hi Everyone,

I am running into issue where I am trying to upgrade my AWS scaleset from R80.40 to R81.20.

I am following https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_AWS_Gateway_Load_Balancer_ASG/CP_CloudGuard_Network_for_AWS_Gateway_Load_Balancer_Auto_Scaling_Group_DeploymentGuide.pdf but having issue where editing User data file.

On page 92 it says to update user data file and i just dont know the correct syntax of the file.

I tried putting plain SIC password and base64 encoded but always get error :

2024-11-12 14:59:53,688 CME_SERVICE ERROR Failed to initialize SIC with gateway instance AWS_Internal (sic-state= uninitialized). Make sure the One-Time Password configured in CME is correct.

I did check sk180606 - CloudGuard Network for AWS provisioning/deployment fails because of incompatibility with the template user data script but still not able to find right way to enter parameter value's.

I have the sic password with me from my old user data file of R80.40 template but seems like am not using or entering it in a right way.

Can anyone please help me with some examples or guide me ?

Much apprecited.

Re: AWS Gateway Load Balancer Auto Scaling Group upgrade user data script issue

Nir_Shamir — Wed, 13 Nov 2024 05:32:18 GMT

Hi,

it should look like this :

sic="$(echo MXEydzNlNHI1dDZ5 | base64 -d)"

If I remember correctly, you need to base64 the hashed password.

Re: AWS Gateway Load Balancer Auto Scaling Group upgrade user data script issue

ajsingh — Wed, 13 Nov 2024 15:24:30 GMT

Hi,

I tried the same syntax and followed the : sk180606 but no success. Still same error complaining about one time password in CME.

I am using template version2 0230117 . I feel like this is not a password issue as same password is working with R80.40 version but not with R81.20 version

Re: AWS Gateway Load Balancer Auto Scaling Group upgrade user data script issue

noamcoh — Sun, 17 Nov 2024 15:54:16 GMT

Hi ajsingh,

You will need to change the SIC parameter and enter it in a base64 format.

Please follow these steps:

Go to your ASG
Find your lunch template
Go to your lunch template
Under lunch template details, click on Actions and then Modify template (create new version)
Expand "Advanced Details"
Go down to User data
You will see something like this:
Go to base64 encoder
Get the base64 value of your password
Put it in the sic variable like this:
sic="$(echo [BASE64_VALUE])"
Example:
sic="$(echo cGFzc3dvcmQ=)"
Click create template version
Scale out a new instance using the new lunch template version

Re: AWS Gateway Load Balancer Auto Scaling Group upgrade user data script issue

ajsingh — Mon, 18 Nov 2024 19:53:06 GMT

Hi, I tried that and got this error on console :

Your cloud-init configuration is corrupt or contains error:
Provided YAML file contains one or more errors:
Error in function _compare_to_schema:
Provided YAML configuration is invalid:
1:
Error: None is not of type 'object'

I copied the script exactly from sk180606 - CloudGuard Network for AWS provisioning/deployment fails because of incompatibility with the template user data script

Re: AWS Gateway Load Balancer Auto Scaling Group upgrade user data script issue

almogar — Tue, 19 Nov 2024 12:30:39 GMT

Double check the syntax in the template file:
sic="$(echo [BASE64_ENCODED_PASSWORD] | base64 -d)"
Ensure there are no trailing spaces or line breaks after pasting the encoded value.

Do you add "#cloud-config" at the top of the cloud-init file?