topic Re: Accelerated Policy Install & SecureXL Templates - Strange Interaction in Firewall and Security Management

Accelerated Policy Install & SecureXL Templates - Strange Interaction

Timothy_Hall — Wed, 02 Feb 2022 20:24:34 GMT

When setting up the new CCSE R81.10 class lab exercises I ran into this somewhat strange interaction between the new Accelerated Policy Install feature and SecureXL templates which does not appear to be documented.

The lab scenario was adding the ALL_DCE_RPC service to a policy rule then install policy, and once this was done as expected all SecureXL templating is halted at that rule (#4 in this case) as shown by fwaccel stat:

Next step was to remove the ALL_DCE_RPC service from rule #4 and reinstall policy (which turned out to be accelerated), but once this was finished fwaccel stat was then showing the following, indicating that all SecureXL Accept/NAT templating was COMPLETELY dead and not just disabled from rule #4:

Needless to say this had me scratching my head trying to figure out what happened. However once I realized that the prior policy installation was accelerated, it was just a matter of forcing an unaccelerated policy install (even with no other changes), which is performed by right-clicking on the gateway icon on the Install Policy screen like this and then hitting the Install button:

Once that was done normal SecureXL templating was restored. Hopefully this will help someone else as fwaccel stat simply showing that templates were "disabled by firewall" with no further information was a tad confusing.

Re: Accelerated Policy Install & SecureXL Templates - Strange Interaction

Kim_Moberg — Wed, 02 Feb 2022 20:34:50 GMT

@Timothy_Hall

I thougth it was a RnD easter eeg feature to force non accellerated policy ??

Re: Accelerated Policy Install & SecureXL Templates - Strange Interaction

Kim_Moberg — Wed, 02 Feb 2022 20:38:14 GMT

@Timothy_Hall

I ser page 14 tells more about this non accelerated access policy. 😂

http://downloads.checkpoint.com/dc/download.htm?ID=108670

Re: Accelerated Policy Install & SecureXL Templates - Strange Interaction

Ilya_Yusupov — Wed, 02 Feb 2022 20:58:48 GMT

Hi @Timothy_Hall ,

Can you please share which JHF is installed? as i tried same procedure now in my lab and it works fine, unless i'm missing some steps in your scenario:).

Thanks,

Ilya

Re: Accelerated Policy Install & SecureXL Templates - Strange Interaction

Timothy_Hall — Wed, 02 Feb 2022 21:17:57 GMT

R81.10 Jumbo HFA Take 30

Re: Accelerated Policy Install & SecureXL Templates - Strange Interaction

Ilya_Yusupov — Wed, 02 Feb 2022 21:33:53 GMT

@Timothy_Hall ,

Thanks indeed replicates, i will take it tomorrow with our RnD to resolved it.

Thanks again for your feedback !!!

Re: Accelerated Policy Install & SecureXL Templates - Strange Interaction

the_rock — Wed, 02 Feb 2022 23:55:12 GMT

I also saw same behavior in R81.10 lab (2 single gateways + mgmt).

Re: Accelerated Policy Install & SecureXL Templates - Strange Interaction

Timothy_Hall — Fri, 11 Feb 2022 15:15:11 GMT

I'd also like to request a way to permanently disable accelerated policy installs due to my latest run in with this feature:

https://community.checkpoint.com/t5/Security-Gateways/Accelerated-Policy-Install-amp-AD-Query-Wizard-Strange/m-p/141093

Re: Accelerated Policy Install & SecureXL Templates - Strange Interaction

Timothy_Hall — Tue, 13 Dec 2022 13:42:53 GMT

FYI this templating issue appears to be fixed in R81.20 GA, not sure about whether the fix is included in a R81.10 Jumbo HFA; I don't see any reference to it as of R81.10 Jumbo Take 81. @Ilya_Yusupov?