topic Re: brief URLF database issue earlier today? lots of 'Inactive Sites' categorizations in Firewall and Security Management

brief URLF database issue earlier today? lots of 'Inactive Sites' categorizations

Lloyd_Braun — Tue, 23 Jan 2024 18:33:52 GMT

Is anyone else seeing a lot of 'Inactive Sites' categorizations today? Looking up the site on the Check Point URL lookup, and the site seems to be categorized correctly.

I can hit the site from one of our edge clusters, but not the other, it appears to be cached as 'Inactive Sites' there.

I have seen this with several websites today, like the URLF database was temporarily returning an 'Inactive Sites' categorization for a brief time, and stuck it in the cache on the gateway. Log history shows these sites categorized correctly through the gateways in the last few days.

Re: brief URLF database issue earlier today? lots of 'Inactive Sites' categorizations

the_rock — Tue, 23 Jan 2024 19:12:28 GMT

I have R81.20 https inspection lab, had not seen this issue today and I tested bunch of sites.

Best,

Andy

Re: brief URLF database issue earlier today? lots of 'Inactive Sites' categorizations

Lesley — Tue, 23 Jan 2024 20:30:59 GMT

No issues here. And what do you mean stuck in cache? You tried to clear it? I think the most common way is to force an update to the gateways. After the incorrect category is changed in the cloud of course.

Re: brief URLF database issue earlier today? lots of 'Inactive Sites' categorizations

Lloyd_Braun — Tue, 23 Jan 2024 20:56:29 GMT

I don't want to make that dbedit change to force the cache to clear upon every policy installation. Though I am considering it. Would be much better if we could just 'fw tab -x' a cache table to clear it, but that does not appear to be possible anymore.

A few sites that displayed this behavior today, seemed to be categorized as Inactive between 8am-12:45 eastern time:

bellmasonjars.com
trabble.com
viewcitation.com
govplus.com

I have checked history on some other sites and they were categorized correctly a few days to a week ago, then were 'Inactive' for a period of time today.

Maybe a one off, or I will have to dig in with support if the behavior continues.

Thanks!

Re: brief URLF database issue earlier today? lots of 'Inactive Sites' categorizations

Lesley — Tue, 23 Jan 2024 21:38:04 GMT

Normal procedure would be:

whitelist false-positive -> https://support.checkpoint.com/results/sk/sk98489

report to Check Point -> same SK

wait to be fixed and check if it is https://urlcat.checkpoint.com/urlcat/

force update on gateways (cache clear not needed) or wait for next update interval (is set in Smartconsole).

Re: brief URLF database issue earlier today? lots of 'Inactive Sites' categorizations

the_rock — Tue, 23 Jan 2024 21:43:40 GMT

Thats excellent advice @Lesley

Re: brief URLF database issue earlier today? lots of 'Inactive Sites' categorizations

Lloyd_Braun — Tue, 23 Jan 2024 22:15:04 GMT

These were already classified correctly by Check Point by the time the service ticket was received, which is why I posted this, seemed like unusual behavior. At that point the datacenter that never saw the request classifies the site properly, while it is stuck in cache at the datacenter that the initial request traversed.

What do you mean by 'force update on gateways' ? Are you saying reloading local database files (#rad_admin urlf update $FWDIR/appi/update/urlf_db.bin) will clear the URLF cache so the categorization override steps are unnecessary?

Re: brief URLF database issue earlier today? lots of 'Inactive Sites' categorizations

the_rock — Tue, 23 Jan 2024 22:41:37 GMT

I think what @Lesley meant was to update the urlf database manually from smart console.

Andy

Re: brief URLF database issue earlier today? lots of 'Inactive Sites' categorizations

Lloyd_Braun — Wed, 24 Jan 2024 13:38:51 GMT

I have a 'Management Update' button that will immediately udpate management but the Security Gateway Updates are scheduled for every 2 hours, no way to force them from r81.20 smartconsole that I'm seeing.

Re: brief URLF database issue earlier today? lots of 'Inactive Sites' categorizations

the_rock — Wed, 24 Jan 2024 13:43:17 GMT

Just click exactly that

Andy

Re: brief URLF database issue earlier today? lots of 'Inactive Sites' categorizations

the_rock — Wed, 24 Jan 2024 13:49:05 GMT

This is from my Azure lab, when I click on that option

Andy