topic Re: Packet Mode search in Firewall and Security Management

Packet Mode search

ED — Thu, 12 Oct 2017 10:25:39 GMT

Hi everyone,

I just tried the new feature in R80.10 called packet mode while searching my policy. But in my case I got an error while searching. No matter what I try to search it fails with this error message. Any idea what the problem could be? R80.10 Jumbo Hotfix Take 42 is installed.

Re: Packet Mode search

PhoneBoy — Thu, 12 Oct 2017 22:48:40 GMT

Anything interesting in $FWDIR/log/cpm.elg or $FWDIR/log/fwm.elg?

Re: Packet Mode search

ED — Fri, 13 Oct 2017 06:45:07 GMT

I ran tail -f $FWDIR/log/cpm.elg while I was trying to do a new search in packet mode. Attached is the error that was thrown.

Re: Packet Mode search

KennyManrique — Fri, 13 Oct 2017 13:16:01 GMT

Have you tried to search with IP addresses instead object names?

I got the same error message "An error ocurred while searching" when try to search object names in packet mode. It works using IP address but sometimes the results are incorrect.

Currently I am using R80.10 SmartConsole Build 005 for connect to R80.10 HFA42 Open Server.

Regards.

Re: Packet Mode search

ED — Fri, 13 Oct 2017 13:46:05 GMT

I tried using IP addresses instead but got same error. I have same version of SmartConsole and management as you.

Re: Packet Mode search

Tomer_Sole — Sun, 15 Oct 2017 06:09:36 GMT

Hi Enis,

For your specific error message as seen in cpm.elg I would like to share the fix. This happens in specific upgrade scenarios, so I would also like to ask you can you please describe your upgrade steps? Did you use R80 and then upgraded to R80.10 via CPUSE? Is this a Multi-Domain environment?

A workaround exists and should be given through Check Point Support. We plan to incorporate the fix in our next hotfix updates.

Re: Packet Mode search

Tomer_Sole — Sun, 15 Oct 2017 06:10:24 GMT

Hi Kenny, please proceed with a task so that Check Point Support will be able to analyze your root cause. obj names should work at all cases.

Re: Packet Mode search

ED — Mon, 16 Oct 2017 07:04:21 GMT

Hi Tomer,

You are correct. I did an upgrade from R80 to R80.10 via CPUSE. It's not a multi-domain environment.

Re: Packet Mode search

Ran_Kopelman — Wed, 18 Oct 2017 12:03:14 GMT

Hi Enis

Can you please add the flowing to your task:

1. postgres.elg file (under $MDS_FWDIR/log/postgres.elg)

2. the content of $MDS_FWDIR/sql_scripts

also please share your task id.

thanks,

Ran

Re: Packet Mode search

ED — Thu, 21 Dec 2017 12:18:02 GMT

Unfortunately this was not fixed in R80.10 Jumbo Hotfix accumulator GA Take 56 or in SmartConsole - General Availability 013. Still the same problem.

Re: Packet Mode search

ED — Tue, 09 Jan 2018 09:02:51 GMT

My problem was fixed by a script that I got from https://community.checkpoint.com/people/ranko795bc55d-ed02-437c-a4f3-88d212bddb02. Thank you so much, great community! It will also be fixed in one of the next JHFs.

Re: Packet Mode search

Tomer_Sole — Tue, 09 Jan 2018 11:22:37 GMT

Enis Dunic wrote:
great community!

we try our best https://community.checkpoint.com/people/eranhda7903ab-5f2e-4b30-b61e-4a7fb341e733‌ https://community.checkpoint.com/people/ranko795bc55d-ed02-437c-a4f3-88d212bddb02‌

Re: Packet Mode search

Vladimir — Sun, 14 Jan 2018 16:37:29 GMT

Can you share the script?

Re: Packet Mode search

ED — Tue, 16 Jan 2018 08:18:56 GMT

Yes if approved by Ran Kopelman and moderator.

How to run

untar -xzvf fix_r8010_search.tar.gz

cd fix_r8010_search

./fix_r8010_search.sh