topic Re: SecureXL Templates show disabled in Firewall and Security Management

SecureXL Templates show disabled

David_C1 — Fri, 21 Jul 2023 14:16:25 GMT

I'm doing some testing with SecureXL in our lab. Currently, output of fwaccel stat reads:

Accept Templates : disabled by Firewall
Layer XXXXX_Policy Access Control disables template offloads from rule #106
Throughput acceleration still enabled.
Drop Templates : disabled
NAT Templates : disabled by Firewall
Layer XXXXXX_Policy Access Control disables template offloads from rule #106
Throughput acceleration still enabled.
LightSpeed Accel : disabled
xxxxxxxx>

And output of fwaccel stats -s:
xxxxxx> fwaccel stats -s
Accelerated conns/Total conns : 25/1401 (1%)
LightSpeed conns/Total conns : 0/1401 (0%)
Accelerated pkts/Total pkts : 2389860528/3129456116 (76%)
LightSpeed pkts/Total pkts : 0/3129456116 (0%)
F2Fed pkts/Total pkts : 739595588/3129456116 (23%)
F2V pkts/Total pkts : 176413090/3129456116 (5%)
CPASXL pkts/Total pkts : 0/3129456116 (0%)
PSLXL pkts/Total pkts : 2246244373/3129456116 (71%)
CPAS pipeline pkts/Total pkts : 0/3129456116 (0%)
PSL pipeline pkts/Total pkts : 0/3129456116 (0%)
CPAS inline pkts/Total pkts : 0/3129456116 (0%)
PSL inline pkts/Total pkts : 0/3129456116 (0%)
QOS inbound pkts/Total pkts : 0/3129456116 (0%)
QOS outbound pkts/Total pkts : 0/3129456116 (0%)
Corrected pkts/Total pkts : 0/3129456116 (0%)
xxxxxxxxx>

And output of fwaccel templates -s:
xxxxxxxxx> fwaccel templates -s

Total number of templates: 198
xxxxxxxxxx>

Rule #106 contains the service object ALL_DCE_RPC, so I understand why this disables templates. When I replace that serivce object with the application control object DCE-RPC Protocol, I get this:

Accept Templates : disabled by Firewall
Drop Templates : disabled
NAT Templates : disabled by Firewall
LightSpeed Accel : disabled
xxxxxxxxx>

and
xxxxxxxx> fwaccel stats -s
Accelerated conns/Total conns : 25/2067 (1%)
LightSpeed conns/Total conns : 0/2067 (0%)
Accelerated pkts/Total pkts : 2389988257/3129646869 (76%)
LightSpeed pkts/Total pkts : 0/3129646869 (0%)
F2Fed pkts/Total pkts : 739658612/3129646869 (23%)
F2V pkts/Total pkts : 176421134/3129646869 (5%)
CPASXL pkts/Total pkts : 0/3129646869 (0%)
PSLXL pkts/Total pkts : 2246359221/3129646869 (71%)
CPAS pipeline pkts/Total pkts : 0/3129646869 (0%)
PSL pipeline pkts/Total pkts : 0/3129646869 (0%)
CPAS inline pkts/Total pkts : 0/3129646869 (0%)
PSL inline pkts/Total pkts : 0/3129646869 (0%)
QOS inbound pkts/Total pkts : 0/3129646869 (0%)
QOS outbound pkts/Total pkts : 0/3129646869 (0%)
Corrected pkts/Total pkts : 0/3129646869 (0%)
xxxxxxxxx>

and
xxxxxxx> fwaccel templates -s

Total number of templates: 260
xxxxxxxx>

The output of fwaccel stats -s and fwaccel templates -s seems to show SecureXL operating as expected, but notice the output of fwaccel stat shows all templates as disabled. Bug? I am running R81.10 with Jumbo HFA Take 95

Dave

Re: SecureXL Templates show disabled

the_rock — Fri, 21 Jul 2023 14:46:22 GMT

I tested in R81.20 and same thing. I know of below sk, but I already have that configured

https://support.checkpoint.com/results/sk/sk71200

Andy

Re: SecureXL Templates show disabled

David_C1 — Fri, 21 Jul 2023 14:57:17 GMT

Thanks Andy. I noticed that sk is for NAT templates only, and for R80.20 and lower. It's odd, hoping it is just a display bug. When I was doing my testing, I had three rules with the ALL_DCE_RPC service. I removed one at a time, checked fwaccel stat each time. After I removed the first two, I saw the rule which disabled templates change. It was only after I removed the third and last instance that all templates showed as disabled. I even re-added the ALL_DCE_RPC service to the last rule, and the output of fwaccel stat returned to what I expected.

Dave

Re: SecureXL Templates show disabled

the_rock — Fri, 21 Jul 2023 14:58:37 GMT

Yea...I dont believe your version is the issue. Lets see if someone can confirm this.

Re: SecureXL Templates show disabled

Timothy_Hall — Fri, 21 Jul 2023 15:15:04 GMT

Force a full policy install to the gateway as shown below and check it again, it is likely that your last policy reinstallation was accelerated:

Re: SecureXL Templates show disabled

the_rock — Fri, 21 Jul 2023 15:31:57 GMT

Just tested, same thing.

Andy

Re: SecureXL Templates show disabled

David_C1 — Fri, 21 Jul 2023 15:45:54 GMT

I don't even have that option for a policy install:

Re: SecureXL Templates show disabled

Timothy_Hall — Fri, 21 Jul 2023 16:34:02 GMT

Right-click on the gateway object on the Install Policy screen and you'll see the hidden checkbox.

Re: SecureXL Templates show disabled

David_C1 — Fri, 21 Jul 2023 16:48:38 GMT

Hey that worked. I now have:

Accept Templates : enabled
Drop Templates : disabled
NAT Templates : enabled
LightSpeed Accel : disabled
xxxxxxx>

Curiously enough, on my other lab firewalls (same version) I essentially went through the process, and fwaccel stat showed "enabled" for Accept and NAT templates as expected.

Dave

Re: SecureXL Templates show disabled

the_rock — Fri, 21 Jul 2023 16:57:02 GMT

This is my output, even after disabling accelerated policy push

Andy

R81.20 jumbo 24

Accept Templates : disabled by Firewall
Layer firewall_layer disables template offloads from rule #16
Throughput acceleration still enabled.
Drop Templates : enabled
NAT Templates : disabled by Firewall
Layer firewall_layer disables template offloads from rule #16
Throughput acceleration still enabled.
LightSpeed Accel : disabled
[Expert@quantum-firewall:0]#

Re: SecureXL Templates show disabled

Timothy_Hall — Fri, 21 Jul 2023 16:59:11 GMT

Yes, because the other firewalls received a full nonaccelerated policy install based on the number of changes you made. But this one's last policy installation was transparently accelerated; you can only determine this if you look at the details of the install policy task where you will see a lightning bolt icon instead of the normal down-arrow.

I've also seen other situations where CLI-level changes to the gateway or SMS don't "take" if the policy installation happens to be accelerated. A forced full policy installation fixes it.

sk169096: Accelerated Install Policy for Access Control Policy

sk168055: SmartConsole shows "Security Gateway and Security Management policy versions are incompatible. Disable Accelerated Install Policy for this Security Gateway and install policy again. For more information, see sk168055."

sk180414: Accelerated policy installation fails with "Policy installation failed on gateway. If the problem persists contact Check Point support (Error code: 1-2000214)

I've gotten to the point where if I make any kind of configuration change that was not performed in the SmartConsole itself yet requires a policy reinstallation to take effect, I always force a full unaccelerated installation as a matter of course. There is no way to permanently disable accelerated policy installs, nor any way to make that hidden checkbox "sticky".

Re: SecureXL Templates show disabled

Timothy_Hall — Fri, 21 Jul 2023 17:35:43 GMT

Disabling accelerated policy push does not rectify a situation where a specific rule is being called out as halting templating, only the situation where "Accept Templates : disabled by Firewall" is being reported by fwaccel stat with no specific rule number displayed.

Re: SecureXL Templates show disabled

the_rock — Fri, 21 Jul 2023 17:36:54 GMT

Right...I also followed things from below link, but same issue

Andy

https://community.checkpoint.com/t5/Security-Gateways/Accept-Templates-are-still-disabled-even-after-disabled-the/td-p/130426

Re: SecureXL Templates show disabled

Timothy_Hall — Fri, 21 Jul 2023 18:14:41 GMT

Your message concerning templating is not the same as the thread OP, please provide a screenshot of rule 16 in your policy. Accept Templates and NAT Templates will follow each other exactly, the issue with templating stopping is always in the Firewall/Network policy layer.

Re: SecureXL Templates show disabled

the_rock — Fri, 21 Jul 2023 18:20:00 GMT

Attached

Andy

Re: SecureXL Templates show disabled

Timothy_Hall — Fri, 21 Jul 2023 18:41:27 GMT

Almost certainly service snmpXdmid is causing templating to stop at that rule, since it is DCE/RPC. Also possibly service dhcpv6-relay which is allowing replies on any port and is also using a custom INSPECT protocol handler. Any chance you can try pulling those two services out of that rule and move them further down? There could possibly be other services in that same rule causing templating to stop as well, but those two in particular stand out to me.

Re: SecureXL Templates show disabled

the_rock — Fri, 21 Jul 2023 19:32:33 GMT

No dice...removed all snmp and dhcp services, same issue.

Re: SecureXL Templates show disabled

the_rock — Fri, 21 Jul 2023 19:41:12 GMT

Screw it...I removed all services, left services as "any"...bam, as Borat would say "GREAT SUCCESS' lol

Now, shows enabled

Accept Templates : enabled
Drop Templates : enabled
NAT Templates : enabled
LightSpeed Accel : disabled
[Expert@quantum-firewall:0]#

Re: SecureXL Templates show disabled

Timothy_Hall — Sat, 22 Jul 2023 15:24:05 GMT

Your "Borat" solution really bugged me and I started to wonder if the relevant content in my Gateway Performance Optimization Course was complete and correct on this topic, so I labbed it up this morning.

As a DCE/RPC object, snmpXdmid definitely stopped templating. The other offender turned out to be the service of type Other "SNMP-Read-Only" which invokes raw INSPECT code in its advanced properties. While this situation was already mentioned in my course material, I have enhanced it with a screenshot and some revised content based on your experience. Here are the updated pages, thanks for helping make the course better:

Re: SecureXL Templates show disabled

the_rock — Sat, 22 Jul 2023 16:13:59 GMT

Thanks for all your hard work on that Tim! By the way, I found it odd that when I removed ALL dhcp and snmp services, it was still not working, so that logically tells me there had to be another service causing it.

Andy