topic Re: Errors on 3 blades - yet they're enabled and seem to be working, according to logging in Firewall and Security Management

Errors on 3 blades - yet they're enabled and seem to be working, according to logging

eth4_ — Sat, 10 Feb 2024 19:49:29 GMT

We see this on an R81.10 gateway:

	Error: 'URL Filtering' is not responding. Verify that 'URL Filtering' is installed on the gateway. If 'URL Filtering' should not be installed verify that it is not selected in the Products List of the gateway (SmartDashboard > Gateway > General Properties > Check Point Products List). This error may occur if the Security Cluster is in Multi-Version Cluster mode. After upgrading all the cluster members to the same version, this error should disappear.
	Error: 'Identity Awareness' is not responding. Verify that 'Identity Awareness' is installed on the gateway. If 'Identity Awareness' should not be installed verify that it is not selected in the Products List of the gateway (SmartDashboard > Gateway > General Properties > Check Point Products List). This error may occur if the Security Cluster is in Multi-Version Cluster mode. After upgrading all the cluster members to the same version, this error should disappear.
	Error: 'Application Control' is not responding. Verify that 'Application Control' is installed on the gateway. If 'Application Control' should not be installed verify that it is not selected in the Products List of the gateway (SmartDashboard > Gateway > General Properties > Check Point Products List). This error may occur if the Security Cluster is in Multi-Version Cluster mode. After upgrading all the cluster members to the same version, this error should disappear.

Output from 'fw stat' and 'enabled_blades':

[Expert@gateway:0]# fw stat
HOST POLICY DATE
localhost Perimeter 7Feb2024 16:06:12 : [>eth0] [<eth0] [>eth1] [<eth1] [>vpnt200] [<vpnt200] [>vpnt201] [<vpnt201] [>vpnt100] [<vpnt100] [>vpnt101] [<vpnt101]
[Expert@gateway:0]# enabled_blades
fw vpn urlf av appi ips identityServer SSL_INSPECT anti_bot content_awareness mon

We see logs for all three blades on this gateway:

So I'm thinking this is cosmetic but the OCD in me doesn't like seeing the splats on the overview page. Also, this survives a reboot.

Anyone have any helpful suggestions?

Re: Errors on 3 blades - yet they're enabled and seem to be working, according to logging

the_rock — Sat, 10 Feb 2024 20:13:31 GMT

I saw this few times in my labs before (on different versions) and way I fixed it was simply by installing policy and also database from smart console. Not sure if its cosmetic, but if blades are enabled and functioning, seems like it could be.

Best,

Andy

Re: Errors on 3 blades - yet they're enabled and seem to be working, according to logging

Lesley — Sat, 10 Feb 2024 22:03:44 GMT

You running VSX? You cannot have those blades enabled in vs0 -> https://support.checkpoint.com/results/sk/sk106496

Re: Errors on 3 blades - yet they're enabled and seem to be working, according to logging

eth4_ — Sun, 11 Feb 2024 12:27:02 GMT

Hello, thank you for your reply, we are not running VSX.

Re: Errors on 3 blades - yet they're enabled and seem to be working, according to logging

the_rock — Sun, 11 Feb 2024 23:25:47 GMT

When did you notice this? Any changes recently? ie upgrade, policy change, any other blades?

Best,

Andy

Re: Errors on 3 blades - yet they're enabled and seem to be working, according to logging

eth4_ — Mon, 12 Feb 2024 14:58:14 GMT

It has been this way for several months but I haven't been too worked up about it because it seemed to be cosmetic. I did try disabling the blades, install database, enable the blades and install database just prior to a service window to change affinity for CoreXL (which requires a reboot). When the gateway came up from reboot the Identity Awareness blade error went away but the other two still show the error.

Re: Errors on 3 blades - yet they're enabled and seem to be working, according to logging

the_rock — Mon, 12 Feb 2024 16:11:59 GMT

One easy fix (if it works of course) wuld be to disable those blades, install policy, re-enable, install policy again. No guarantee, but easy to try.

Best,

Andy

Re: Errors on 3 blades - yet they're enabled and seem to be working, according to logging

eth4_ — Tue, 13 Feb 2024 19:59:08 GMT

Hello,

Unless I'm missing something, it isn't that easy to do without re-writing my rulebase to remove dependencies for rules written on those blades?

Re: Errors on 3 blades - yet they're enabled and seem to be working, according to logging

the_rock — Tue, 13 Feb 2024 20:01:21 GMT

Only way to know would be to uncheck it, save and see if it complains about anything.

Best,

Andy

Re: Errors on 3 blades - yet they're enabled and seem to be working, according to logging

Lesley — Tue, 13 Feb 2024 21:12:53 GMT

I think it will give messages if you disable blades that are in 'use'

Maybe we should focus on the mgmt and not gateways? Have you rebooted FWMGT?

Maybe this SK helps:

https://support.checkpoint.com/results/sk/sk111944

Re: Errors on 3 blades - yet they're enabled and seem to be working, according to logging

the_rock — Tue, 13 Feb 2024 23:30:51 GMT

Thats good sk to follow, agree.

Andy

Re: Errors on 3 blades - yet they're enabled and seem to be working, according to logging

CheckPointerXL — Fri, 16 Feb 2024 17:02:12 GMT

reboot mgmt fixed the issue for me last week

Re: Errors on 3 blades - yet they're enabled and seem to be working, according to logging

the_rock — Fri, 16 Feb 2024 17:59:58 GMT

I always found rebooting the gateway fixed it for me, but does not hurt to reboot the mgmt, for sure...no downtime needed.

Best,

Andy