topic Re: remove proxy config in Firewall and Security Management

remove proxy config

Steve_Payne1 — Mon, 01 Nov 2021 11:34:37 GMT

we used to get all ips and other updates via a proxy,

we are decommissioning these but the mgmt boxes are still going to proxy for signature checks

where in the CLI can i find where the proxy setting has stuck, even though its turned off in gui and smartconsole

this is for R81

thanks

sigcheck.checkpoint.com	Blocked	72.247.177.81
sigcheck.checkpoint.com	Blocked	72.247.177.81
sigcheck.checkpoint.com	Blocked	72.247.177.81
sigcheck.checkpoint.com	Blocked	72.247.177.81
sigcheck.checkpoint.com	Blocked	72.247.177.81
sigcheck.checkpoint.com	Blocked	72.247.177.81
sigcheck.checkpoint.com	Blocked	72.247.177.81

Re: remove proxy config

Chris_Atkinson — Tue, 02 Nov 2021 00:19:28 GMT

Did you check all areas of SmartConsole including the object itself and global properties?

Menu > Global Properties > Proxy
Object > Network Management > Proxy

clish > show proxy

After the change does the issue persist even following a cpstop/cpstart or reboot?

Re: remove proxy config

jgriffiths — Fri, 12 Nov 2021 11:35:21 GMT

Hi Chris,

I work with Steve and I've been looking into this issue. We've checked all proxy configuration on the appliances themselves and also via SmartConsole, all of which don't have the proxy settings configured. The appliances/management platforms have been rebooted following the removal of the proxy configuration.

I've identified the proxy configuration remains under the ics_configuration > signature > updates > proxy_address of the management platform database - this was identified with GuiDBedit.

From what I understand this section is applicable for threat prevention signature updates. We're in the process of decommissioning our proxies and having the proxy configured may cause us a problem once they've been turned off.

Are you able to confirm whether my understanding is correct? i.e. signature updates will cease once the proxies are turned off, and also whether we can use GuiDBedit to remove the proxy configuration?

Thanks,

Re: remove proxy config

GMynott — Fri, 11 Mar 2022 00:20:22 GMT

Hello there,

We have noticed the same issue with our appliances and management server.
Recently removed the proxy configuration via Clish, SmartConsole, and Global Properties, however some connections are still using the proxy.

Via GuiDBEdit I found the following setting still configured with the proxy:
- Managed Objects > asm > ProductVPN1PRO > fdt_proxy_address
- Other > content_security > Global_EDGE_Settings > signature_updates > proxy_address
- Other > content_security > Global_AV_Settings > signature_updates > proxy_address
- Other > ics_configuration > Global_ICS_Settings > signature_updates > proxy_address
- Other > uf_policy > Global_UF_DB_Updates_user_modified > proxy_address

@jgriffiths did you manage to resolve this by editing the database?
@Chris_Atkinson is editing the database the preferred way to fully remove the proxy?

Cheers

Re: remove proxy config

jgriffiths — Fri, 11 Mar 2022 09:40:38 GMT

Hi, the config still exists in the DB, we were advised against directly editing the database if possible. We were able to confirm the Gateways/Management servers were able to reach the required FQDN using curl

curl_cli sigcheck.checkpoint.com:80 -v

You should get a response like the below

Connected to sigcheck.checkpoint.com (72.247.177.160) port 80 (#0)

Even though the proxy config remains its not in use. The proxies are no more and it still works.

Cheers,

Re: remove proxy config

Chris_Atkinson — Fri, 11 Mar 2022 12:12:15 GMT

Please work with TAC to address, generally editing the database in such a fashion is otherwise unsupported.