topic Re: Accelerated Drop Rules feature 'sim dropcfg' in Firewall and Security Management

Accelerated Drop Rules feature 'sim dropcfg'

Martijn — Tue, 07 Apr 2020 09:28:33 GMT

Hi All,

On a R80.10 gateway with jumbo take 272 I am testing the Accelerated Drop Rules feature from sk67861. I have created a file with IP-addresses, but get an error when importing this file.

ioctl to the SecureXL device failed (rc=-1, errno=12)
ioctl failed

The file contains 6694 entries, so maybe this is above some kind of limit. So I created a file with only one IP-address and this seems to work:

[Expert@FW:0]# sim dropcfg -f test
Drop rules (Match after conn lookup):
Enforced on all interfaces
Source Destination DPort PR
------------------ ------------------ ----- ---
1.1.1.1/32 * * *

Are you sure you want to continue (Y/N) ?
y
drop entries configured successfully

But when I check to see if everything is OK, I get the following error:

[Expert@FW:0]# sim dropcfg -l
ioctl getdropcfg#1 failed

Has anyone used this function before with success? Does any one know what those errors mean? Is there a limit for the number of entries in the file?

Best regards, Martijn

Re: Accelerated Drop Rules feature 'sim dropcfg'

PhoneBoy — Wed, 08 Apr 2020 00:19:25 GMT

Looks like a known bug: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk102346
Even though your version is theoretically not listed you should get the TAC involved.

Re: Accelerated Drop Rules feature 'sim dropcfg'

Martijn — Wed, 08 Apr 2020 12:56:53 GMT

Thanks.

TAC is involved, but can not tell me what the message means.
I hope to get an answer soon

Re: Accelerated Drop Rules feature 'sim dropcfg'

Timothy_Hall — Wed, 08 Apr 2020 15:11:46 GMT

There are definitely length limits for various SecureXL blocking features, see this related thread:

https://community.checkpoint.com/t5/Enterprise-Appliances-and-Gaia/SecureXL-DoS-Rate-Limiting-samp-rules/m-p/71301

Re: Accelerated Drop Rules feature 'sim dropcfg'

Martijn — Fri, 17 Apr 2020 08:26:18 GMT

Hi All,

TAC advised us to use the 'fw samp batch' methode which we did and this was succesfull.

Regards,

Martijn.