topic Re: IPS Management Update requires manual update in Firewall and Security Management

IPS Management Update requires manual update

usukhbayar_g — Mon, 27 Oct 2025 03:54:42 GMT

Hello, community.

This issue has been here for almost 2 months. (I guess)

IPS update always requiring manual update from SmartConsole (Custom Policy->Updates-> Update Now

Also blade:IPS AND type:Control shows below.

Yes, I tried sk180762.
[Expert@mn-dc1-r1c1-sec-fw.sg-ch01-01:0]# curl_cli -v -k http://dl3.checkpoint.com
* Rebuilt URL to: http://dl3.checkpoint.com/
* Trying 23.221.70.126...
* TCP_NODELAY set
* Connected to dl3.checkpoint.com (23.221.70.126) port 80 (#0)
< HTTP/1.1 302 Moved Temporarily
< Server: AkamaiGHost
< Content-Length: 0
< Location: http://downloads.checkpoint.com/dc/fileerror.htm
< Date: Mon, 27 Oct 2025 03:50:42 GMT
< Connection: keep-alive
<
* Connection #0 to host dl3.checkpoint.com left intact
[Expert@mn-dc1-r1c1-sec-fw.sg-ch01-01:0]# curl_cli -v -k http://updates.checkpoint.com
* Rebuilt URL to: http://updates.checkpoint.com/
* Trying 18.64.8.40...
* TCP_NODELAY set
* Connected to updates.checkpoint.com (18.64.8.40) port 80 (#0)
< HTTP/1.1 404 Not Found
< Content-Type: text/plain; charset=utf-8
< Content-Length: 15
< Connection: keep-alive
< Date: Mon, 27 Oct 2025 03:50:53 GMT
< Server: awselb/2.0
< X-Cache: Error from cloudfront
< Via: 1.1 41a89bdb610eb303e698e5cb65ce5b76.cloudfront.net (CloudFront)
< X-Amz-Cf-Pop: ICN57-P2
< X-Amz-Cf-Id: 9FUSRIj4yugTyD4vDgHzT5VX1gMsFIXgGy1VAPiYeUtq7-SI7XPlDg==
<
* Connection #0 to host updates.checkpoint.com left intact
Page not found!

Since I know its not license. Did someone encoutered this issue, if yes, how did you resolved it?

SmartConsole version: 81.20.9700.671

Re: IPS Management Update requires manual update

the_rock — Mon, 27 Oct 2025 04:00:35 GMT

Silly question, but I suppose updates are set as scheduled in smart console? Can you ping updates.checkpoint.com?

Re: IPS Management Update requires manual update

usukhbayar_g — Mon, 27 Oct 2025 04:03:02 GMT

Yes, I can.

PING d3dzd94mv2pmza.cloudfront.net (18.64.8.106) 56(84) bytes of data.
64 bytes from server-18-64-8-106.icn57.r.cloudfront.net (18.64.8.106): icmp_seq=1 ttl=242 time=205 ms
64 bytes from server-18-64-8-106.icn57.r.cloudfront.net (18.64.8.106): icmp_seq=2 ttl=242 time=204 ms
64 bytes from server-18-64-8-106.icn57.r.cloudfront.net (18.64.8.106): icmp_seq=3 ttl=242 time=204 ms
64 bytes from server-18-64-8-106.icn57.r.cloudfront.net (18.64.8.106): icmp_seq=4 ttl=242 time=204 ms
64 bytes from server-18-64-8-106.icn57.r.cloudfront.net (18.64.8.106): icmp_seq=5 ttl=242 time=204 ms
^C
--- d3dzd94mv2pmza.cloudfront.net ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4459ms
rtt min/avg/max/mdev = 204.404/204.566/205.133/0.638 ms

Re: IPS Management Update requires manual update

the_rock — Mon, 27 Oct 2025 04:06:56 GMT

K great. Well, since its midnight where I am, going to sleep, but will send you few things when I wake up from my lab, so you can verify in your environment.

Re: IPS Management Update requires manual update

usukhbayar_g — Mon, 27 Oct 2025 04:08:46 GMT

Sure, good night then xD

Re: IPS Management Update requires manual update

the_rock — Mon, 27 Oct 2025 10:33:02 GMT

Hey @usukhbayar_g ,

Just to be 100% sure, can you compare what I attached here from the lab?

***********************

[Expert@CP-MANAGEMENT:0]# curl_cli -k updates.checkpoint.com
Page not found![Expert@CP-MANAGEMENT:0]# curl_cli -k cws.checkpoint.com
<HTML><HEAD><TITLE>Error</TITLE></HEAD><BODY>
An error occurred while processing your request.<p>
Reference #97.46182117.1761560792.4b7f98c7
<P>https://errors.edgesuite.net/97.46182117.1761560792.4b7f98c7</P>
</BODY></HTML>
[Expert@CP-MANAGEMENT:0]# ^C
[Expert@CP-MANAGEMENT:0]# curl_cli -k google.com
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="http://www.google.com/">here</A>.
</BODY></HTML>
[Expert@CP-MANAGEMENT:0]#

Re: IPS Management Update requires manual update

emmap — Mon, 27 Oct 2025 11:11:40 GMT

Is there a proxy server configured in Gaia or in SmartConsole for the SMS? When you manually update the IPS in SmartConsole it can use the internet connection from the PC you're running SmartConsole on (I think it gives you the option), and when you use 'curl_cli', unless you explicitly set a proxy in your command, it won't use one, regardless of proxy config.

Re: IPS Management Update requires manual update

the_rock — Mon, 27 Oct 2025 11:15:17 GMT

EXCELLENT point Emma. Did not think of that, but makes total sense.

Re: IPS Management Update requires manual update

usukhbayar_g — Mon, 27 Oct 2025 12:01:29 GMT

Only thing differs from your output is, when i curl_cli -k cws.checkpoint.com

[Expert@mn-dc1-r1c1-sec-fw.sg-ch01-02:0]# curl_cli -k cws.checkpoint.com
<html><body><h1>It works!</h1></body></html>

Re: IPS Management Update requires manual update

the_rock — Mon, 27 Oct 2025 12:04:30 GMT

What about curl_cli -k google.com? FWIW, just to be sure, machine where smart console is instralled has full Internet connectivity? Also, what dns servers are configured on it?

Re: IPS Management Update requires manual update

usukhbayar_g — Mon, 27 Oct 2025 12:05:31 GMT

Hi @emmap,
There is no proxy configured in this environment. So I guess I don't have to set a proxy option in my command.

Re: IPS Management Update requires manual update

usukhbayar_g — Mon, 27 Oct 2025 12:09:16 GMT

[Expert@mn-dc1-r1c1-sec-fw.sg-ch01-02:0]# curl_cli -k google.com
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="http://www.google.com/">here</A>.
</BODY></HTML>
[Expert@mn-dc1-r1c1-sec-fw.sg-ch01-02:0]#

Machine running SmartConsole has full internet connectivity. And DNS is set to local DNS server.

Re: IPS Management Update requires manual update

the_rock — Mon, 27 Oct 2025 12:18:19 GMT

Can you try testing with google dns?

Re: IPS Management Update requires manual update

the_rock — Mon, 27 Oct 2025 15:24:01 GMT

Do you get same output from both fw AND mgmt server?

Re: IPS Management Update requires manual update

the_rock — Mon, 27 Oct 2025 18:06:12 GMT

Just curious, did this ever work?

Re: IPS Management Update requires manual update

usukhbayar_g — Fri, 31 Oct 2025 09:08:21 GMT

If you are talking about automatic update, yes. Also we don't have proxy before and after this issue shows up.

Re: IPS Management Update requires manual update

Machine_Head — Fri, 31 Oct 2025 10:24:15 GMT

To update IPS database on a gateway you roughly have two options, as defined in the gateway object IPS tab:

First one is directly from gateway.
Second one from Manager
- via Manual or scheduled DB download
  - then pushing TP policy manual or scheduled too

In the Title you mention "management" udpate but in the screenshots you show a gateway failing to download the package.

So what are you really trying to troubleshoot? The gateway or the manager?

To find more detail about why the gateway is failing to download the package you can debug FWD

Make sure to check this sk also
https://support.checkpoint.com/results/sk/sk179425

Re: IPS Management Update requires manual update

the_rock — Fri, 31 Oct 2025 12:24:01 GMT

I believe they have all that set up already, but good sk to follow, for sure.