topic Re: Anti-Bot response with wrong status code in Firewall and Security Management

Anti-Bot response with wrong status code

gurowar — Tue, 24 Sep 2024 16:54:37 GMT

Good day all,

I was wondering if anyone had a similar issue with there smartconsole, I have a pair of 16200 firewalls, managing them via smartconsole. I noticed in the logs that I am getting a lot of Anti-bot system alerts. It seems to start up around 6am and stops about 4-5pm. I haven't looked at all the messages but the 2 or 3 I opened up today are:

Response with wrong status code., check /opt/CPsuite-R81.10/fw1/log/rad_events/Errors/flow_75937_42293907 For more details

[rad_curl_task.cpp:123] CRadCurlTask::run: [ERROR] Response status = 504

not sure what that means but that is all I see in the logs

Failed to Decrypt CP Site Response., check /opt/CPsuite-R81.10/fw1/log/rad_events/Errors/flow_75937_42306671 For more details

Flow Termination Status:Failed!

FlowError=Failed to Decrypt CP Site Response.

[rad_keyset.cpp:49] CRadRepositoryContaineData::getRadEncKeyByServiceKey: [INFO] no key found for requested service: malware+0returning default

[rad_decrypted_response_task.cpp:134] CRadDecryptedResponseTask::decrypt: [ERROR] response size is 1232944' limit to 1000000
[rad_decrypted_response_task.cpp:80] CRadDecryptedResponseTask::getResponseString: [ERROR] failed to decrypt response 0xdd054518
[rad_response_task.cpp:67] CRadResponseTask::run: [ERROR] can not get response string

What key is this looking for?

Going to check the rest of the logs but the 3 I opened, 2 of them has that Response with wrong status code and the other one Failed to Decrypt CP Site Response

Is this a problem or is this normal?

Thank you in advance!!

Re: Anti-Bot response with wrong status code

Lesley — Tue, 24 Sep 2024 17:32:15 GMT

Please share $FWDIR/conf/rad_conf.C from relevant gateway

Re: Anti-Bot response with wrong status code

gurowar — Tue, 24 Sep 2024 17:34:51 GMT

Here is the output

[Expert@Firewall01:0]# cat $FWDIR/conf/rad_conf.C
(
:urlfs_service_check_seconds (7200)
:amws_service_check_seconds (1800)
:cpu_cores_as_number_of_threads (false)
:number_of_threads (0)
:threads_to_cores_ratio (0.334)
:minimal_resources_usage_ratio (0.2)
:number_of_threads_fast_response (0)
:number_of_threads_slow_response (0)
:queue_max_capacity (2000)
:debug_traffic (false)
:use_dns_cache (true)
:dns_cache_timeout_sec (2)
:use_ssl_cache (true)
:cert_file_name ("ca-bundle.crt")
:cert_type ("CRT")
:ssl_version ("TLSv1_0")
:ciphers ("TLSv1")
:autodebug (true)
:timeout_events (false)
:normal_flow_events (false)
:log_timeouts (false)
:log_errors (true)
:number_of_reports (512)
:max_repository_multiplier (20)
:flow_timeout (6)
:excessive_flow_timeout (120)
:transfer_timeout_sec (15)
:max_flows (2000)
:max_pc_in_reply (0)
:retry_mechanism_on (true)
:max_retries (25)
:retry_peroid_mins (15)

)
[Expert@Firewall01:0]#

Re: Anti-Bot response with wrong status code

Lesley — Tue, 24 Sep 2024 18:00:49 GMT

You can start with below. If you don't trust open TAC case and they can give you custom advise (every setup is different)

Edit file on both cluster members and save it. After change: rad_admin stop ; sleep 5 ; rad_admin start

Sleep is important!

urlfs_service_check_seconds (7200)
:amws_service_check_seconds (7200)
:cpu_cores_as_number_of_threads (false)
:number_of_threads (0)
:threads_to_cores_ratio (0.334)
:minimal_resources_usage_ratio (0.2)
:number_of_threads_fast_response (0)
:number_of_threads_slow_response (0)
:queue_max_capacity (4000)
:debug_traffic (false)
:use_dns_cache (true)
:dns_cache_timeout_sec (2)
:use_ssl_cache (true)
:cert_file_name ("ca-bundle.crt")
:cert_type ("CRT")
:ssl_version ("TLSv1_0")
:ciphers ("TLSv1")
:autodebug (false)
:timeout_events (false)
:normal_flow_events (false)
:log_timeouts (false)
:log_errors (true)
:number_of_reports (512)
:max_repository_multiplier (20)
:flow_timeout (6)
:excessive_flow_timeout (120)
:transfer_timeout_sec (15)
:max_flows (3000)
:max_pc_in_reply (0)
:retry_mechanism_on (true)
:max_retries (25)
:retry_peroid_mins (15)

Re: Anti-Bot response with wrong status code

gurowar — Tue, 24 Sep 2024 18:05:15 GMT

Hi Lesley,

Will try and keep you posted I have a call with checkpoint tomorrow as well but let me try your suggestion first, then see what they say.

Keep you posted but for now thank you!!!!

Re: Anti-Bot response with wrong status code

gurowar — Wed, 25 Sep 2024 16:54:09 GMT

Just an update on this, talked to Checkpoint and what we did was

sed -i 's/:autodebug (true)/:autodebug (false)/' $FWDIR/conf/rad_conf.C
rad_admin stop ; sleep 5 ; rad_admin start

didn't have to make any changes to the other fields in the rad_conf.C file as I am told this should cause an auto calculation for rest of the values in the file. Made the changes an hour ago and so far haven't seen an Anti-Bot alert but we will see.

Re: Anti-Bot response with wrong status code

gurowar — Fri, 27 Sep 2024 16:47:15 GMT

Good day all,

Happy Friday!!! Just to give an update on this, the only change that was recommended was to change

:autodebug (false)

and nothng else because by doing this, this change will automatically update the rest of the values in the rad.config.C. So I what was recommended but nothing changed in the past day. Not sure if that was because it didn't work or the way it is configured is the ways it supposed to be, minus the autodebug. So what I did was updated just 2 things that suggested here to and left autodebug to false to see if if will auto configure as they say. But we are making progress there is a lot less Auto-Bot messages scrolling in, hopefully updating the 2 setting will drop it more but we will see.

[Expert@Firewall01:0]# cat $FWDIR/conf/rad_conf.C
(
:urlfs_service_check_seconds (7200)
:amws_service_check_seconds (5400)
:cpu_cores_as_number_of_threads (false)
:number_of_threads (0)
:threads_to_cores_ratio (0.334)
:minimal_resources_usage_ratio (0.2)
:number_of_threads_fast_response (0)
:number_of_threads_slow_response (0)
:queue_max_capacity (4000)
:debug_traffic (false)
:use_dns_cache (true)
:dns_cache_timeout_sec (2)
:use_ssl_cache (true)
:cert_file_name ("ca-bundle.crt")
:cert_type ("CRT")
:ssl_version ("TLSv1_0")
:ciphers ("TLSv1")
:autodebug (false)
:timeout_events (false)
:normal_flow_events (false)
:log_timeouts (false)
:log_errors (true)
:number_of_reports (512)
:max_repository_multiplier (20)
:flow_timeout (6)
:excessive_flow_timeout (120)
:transfer_timeout_sec (15)
:max_flows (2000)
:max_pc_in_reply (0)
:retry_mechanism_on (true)
:max_retries (25)
:retry_peroid_mins (15)

Re: Anti-Bot response with wrong status code

gurowar — Wed, 02 Oct 2024 15:44:58 GMT

Good day all,

Just wanted to update on this, looks like changing the following in rad_conf.C

:amws_service_check_seconds (5400)

:queue_max_capacity (4000)

:autodebug (false)

has quieted the Anti-bot logs, not completely but quit a bit. So far today we only have 3, also perhaps I misunderstood the engineer but turning off autodebug, in due time it would auto configure teh settings in rad_conf.C file but since I made the changes last week Friday, they are still the same. I would assume it would have auto correct by now. I will monitor the rest of the week and if there is any changes or update will let you know. But for now this seems to have fixed my issue.

Thank you, All!!

Warren

Re: Anti-Bot response with wrong status code

JP_Rex — Tue, 12 Nov 2024 11:17:18 GMT

Please also check

sk182494 - Anti-Bot Blade generates error logs with the reason "Failed to Decrypt CP Site Response"

Regards

Peter

Re: Anti-Bot response with wrong status code

Itall — Wed, 11 Dec 2024 14:54:32 GMT

queue_max_capacity must be greater than max_flows in ratio 1:2 sk182136 - RAD process unexpectedly exits when a cluster failover or a Security Gateway reboot occurs