topic Objects not visible in Object Explorer despite existing in ClusterXL setup in Firewall and Security Management

Objects not visible in Object Explorer despite existing in ClusterXL setup

IGSSV — Mon, 26 Aug 2024 13:02:02 GMT

Hello,

I'm facing an issue where two hosts configured in a ClusterXL setup are not visible in the Object Explorer. I need to reference these hosts in a policy, so I tried to create host objects for them. However, I received an error message indicating that the objects already exist (as shown in the attached screenshot).

Despite this, I'm unable to see these objects in the Object Explorer.

Environment:

Smart-1: VM (currently in testing phase)
Security Gateway: Checkpoint 9100 x2

Issue:

Two hosts configured in ClusterXL are not visible in the Object Explorer.
Attempting to create host objects results in an error stating the objects already exist.

ClusterXL appears to be functioning normally.Smart-1 host alert is only about the trial license expiring.Hosts are not visible in "Gateways and Servers" or any other category after searching.Error message displayed when attempting to manually create host objects.

Any assistance would be greatly appreciated.

Thank you.

Re: Objects not visible in Object Explorer despite existing in ClusterXL setup

G_W_Albrecht — Mon, 26 Aug 2024 13:43:29 GMT

Please show where the host have been created and for what reason!

Re: Objects not visible in Object Explorer despite existing in ClusterXL setup

AkosBakos — Mon, 26 Aug 2024 14:09:07 GMT

Hi @IGSSV

Did you try database install? Just to be sure.
A cpstop;cpstart in not an axact solution, but can help. 🙂

Run $MDS_FWDIR/scripts/run_cpmdoc.sh, maybe this point out something. Let's see what shows.

Akos

Re: Objects not visible in Object Explorer despite existing in ClusterXL setup

IGSSV — Mon, 26 Aug 2024 15:03:40 GMT

I thought that when creating a cluster, the objects of the cluster members would be created automatically.
I did not create the host manually.

Before creating the cluster, I imported objects using the API (ExportImportPolicyPackage-master), but the host in question was not created.

Re: Objects not visible in Object Explorer despite existing in ClusterXL setup

the_rock — Mon, 26 Aug 2024 15:27:55 GMT

They are NOT created automatically. You need to add them manuially from smart console. As far as smart-1 mgmt server, its expected it does not show up, I cofirmed that with R&D while ago and Im sure it has not changed, at least not in R81.20.

Andy

Re: Objects not visible in Object Explorer despite existing in ClusterXL setup

IGSSV — Mon, 26 Aug 2024 15:31:07 GMT

What kind of operation is database installation? Is it different from policy installation?
I tried cpstop; cpstart on both Smart-1 and SecurityGW, but the situation remains unchanged.
The results (summary) of CPM Doctor are as follows. It contains some customer information, so if you tell me, I will mask the details as needed and present them.

Version: R81.20 Hot Fixes: FW1: HOTFIX_VCE_R81_20_AUTOUPDATE HOTFIX_NGM_DOCTOR_AUTOUPDATE HOTFIX_WEBCONSOLE_AUTOUPDATE HOTFIX_PUBLIC_CLOUD_CA_BUNDLE_AUTOUPDATE HOTFIX_GOT_TPCONF_MGMT_AUTOUPDATE MGMT: NO HOTFIXES.. Setup: Security Management Server Machine's name: XXXXXXXX Type: Primary Date: Tue Aug 27 00:11:54 JST 2024 Running mode: REGULAR OK Icon 153 Tests Error Icon 1 Tests Warning Icon 2 Tests Info Icon 43 Tests The following are tests with Alert or higher: - Missing IpsUpdateInspectFileList - HTTPSi Rules Exist In Legacy HTTPSi Policy Check - Test Result Icon Java Xmx Check

Re: Objects not visible in Object Explorer despite existing in ClusterXL setup

IGSSV — Mon, 26 Aug 2024 15:42:14 GMT

I see, they are not created automatically.

In that case, was it necessary to create the host as "Gateways and Servers" before creating the cluster with the wizard?

If I create the host in the current state, I think it will be registered as a normal host.

Also, it seems that a duplicate error occurs at the time of creation, but is it okay to ignore this?

Re: Objects not visible in Object Explorer despite existing in ClusterXL setup

PhoneBoy — Mon, 26 Aug 2024 17:11:07 GMT

I suspect the solution will be similar to: https://support.checkpoint.com/results/sk/sk126872

Re: Objects not visible in Object Explorer despite existing in ClusterXL setup

the_rock — Mon, 26 Aug 2024 17:13:03 GMT

Funny you mentioned that sk, as it did come to my mind, since I used it before, but only for groups related to anti-spoofing, nothing else. Not sure it may apply in this scenarion, but definitely worth a try.

Andy

Re: Objects not visible in Object Explorer despite existing in ClusterXL setup

AkosBakos — Mon, 26 Aug 2024 17:47:44 GMT

Hi @IGSSV

q: What kind of operation is database installation? Is it different from policy installation?

a: Yes, you can find in the main menu in the top left corner of smartconsole. It related to SmartCenter and Logservers

I prefer manual cluster creation to Wizard. As I see the guys gave tha solution for you. 🙂

Akos

Re: Objects not visible in Object Explorer despite existing in ClusterXL setup

the_rock — Mon, 26 Aug 2024 18:04:02 GMT

Think of it this way...installing the database is sort of like pushing policy to the mgmt server (if thats even right way to put it), but its more if you ever create new admin in smart console or something changes in guidbedit, I always install database, simply "refreshes" mgmt database, thats all. You can do that literally any time.

Andy

Re: Objects not visible in Object Explorer despite existing in ClusterXL setup

IGSSV — Mon, 26 Aug 2024 18:15:39 GMT

Thank you.

Based on the SK you provided, I was able to find the relevant Security Gateway as a Network Object.

However, there was no cdm_auto_calculated item as mentioned in the SK, so I couldn't do anything further. It seems that the object does exist.

Re: Objects not visible in Object Explorer despite existing in ClusterXL setup

IGSSV — Mon, 26 Aug 2024 18:17:36 GMT

Thank you for your reply.

I tried the database installation, but the situation did not change.

Is it possible that this is happening because the VM has low allocated resources in the test environment?

Virtual Memory: 8GB
Virtual CPU: 2 cores

Re: Objects not visible in Object Explorer despite existing in ClusterXL setup

the_rock — Mon, 26 Aug 2024 18:23:15 GMT

From my lab below (cluster object and cluster members). Can you send what you see in your setup? (just blur out sensitive info).

Btw, what options do you see when you single click on the cluster member object? (bottom pane)?

Re: Objects not visible in Object Explorer despite existing in ClusterXL setup

Bob_Zimmerman — Mon, 26 Aug 2024 19:18:25 GMT

Why are you trying to make a host object with the same name as a cluster member object? Just use the cluster in the policy.

Re: Objects not visible in Object Explorer despite existing in ClusterXL setup

IGSSV — Tue, 27 Aug 2024 01:52:23 GMT

Thank you for your reply.

I will include a screenshot below.

It seems that there are also member objects, just like in your lab environment.The contents were like this.

Re: Objects not visible in Object Explorer despite existing in ClusterXL setup

IGSSV — Tue, 27 Aug 2024 02:08:46 GMT

I'm trying to write rules for Mgmt for SSH and Snmp

and some PBR

Re: Objects not visible in Object Explorer despite existing in ClusterXL setup

IGSSV — Tue, 27 Aug 2024 01:56:42 GMT

I understand. Thank you for the clear explanation!

Re: Objects not visible in Object Explorer despite existing in ClusterXL setup

the_rock — Tue, 27 Aug 2024 02:01:46 GMT

No problem!

Re: Objects not visible in Object Explorer despite existing in ClusterXL setup

emmap — Tue, 27 Aug 2024 03:00:09 GMT

You can just use the cluster object for this, it includes the cluster members and their interface IPs.