topic Re: IPS not enabled but still receiving notice of expired blade in Firewall and Security Management

IPS not enabled but still receiving notice of expired blade

Tony_Graham — Mon, 21 Aug 2023 16:52:10 GMT

All,

I have an r81.10 install that does not have IPS enabled in the gateway object.

The settings on the gateway device as presented by SmartConsole Threat Prevention tab are as follows:

Custom Threat Prevention is ticked.

All other boxes are unticked on that tab,

The drop down menus on the left do not contain any IPS related entries so it would seem it is not activated.

However, the main overview of all gateways & servers I have big red X and an Alert for this device that IPS

is 'Expired'.

I imagine this due to the installed license key on this device since this device is retired,

I assume I can still use this device for some basic blocking. Is there a way to remedy the Alert

for an unused blade or just live with it?

Re: IPS not enabled but still receiving notice of expired blade

the_rock — Mon, 21 Aug 2023 16:58:58 GMT

Can you please send a screenshot of it, as well as output of cplic print -x?

Andy

Re: IPS not enabled but still receiving notice of expired blade

Tony_Graham — Mon, 21 Aug 2023 17:13:02 GMT

I may have located the issue. While Smart Console shows IPS is disabled, the device console shows IPS is activated but expired.

Since they are out of synch with each other it is probably where the issue lies. The attached screenshots, the one labelled 'device' shows the active but expired blade output on the device itself the other two screenshots are out of Smart Console (81.20)

Re: IPS not enabled but still receiving notice of expired blade

the_rock — Mon, 21 Aug 2023 17:15:54 GMT

That would make sense, for sure. Maybe if you can locate license string for it from ssh, you can do cplic del command. Just make sure you dont get rid of existing license needed.

Andy

Re: IPS not enabled but still receiving notice of expired blade

Tony_Graham — Mon, 21 Aug 2023 17:21:30 GMT

Here is the cplic mess with some redactions.

28May2023 CPSM-C-U CPSB-NPM CPSB-EPM CPSB-LOGS CPSB-MNTR CPSB-PRVS CPSB-UDIR CPSB-W
KFL-100 CPSB-WS CPSB-MPTL CPVP-SNX-U-NGX CPSB-SWB CPSB-ADNC-M CPSB-RPRT-U CPSB-EVCR-U CPSB-SSLVPN-MOBMAIL+5000 CPSB-COMP-150

28May2023      CPSG-C-8-U CPSB-FW CPSB-VPN CPSB-IPSA CPSB-DLP CPSB-SSLVPN-U CPSB-IA CPSB
-ADNC CPSG-VSX-25S CPSB-SWB CPSB-IPS CPSB-AV CPSB-URLF CPSB-ASPM CPSB-APCL CPSB-ABOT CPSB-CTNT
never       CPAP-SG320X CPSB-FW CPSM-C-2 CPSB-VPN CPSB-NPM CPSB-LOGS CPSB-IA CPSB-SSL
VPN-5 CPSB-ADNC CPSB-IPS-S1 CPSB-URLF CPSB-ABOT CPSB-APCL CPSB-ASPM CPSB-AV CPSB-CTNT

Contract Coverage:
#   ID          Expiration   SKU
===+===========+============+====================
1    | 1May2023 | CPSB-EBP-TE
  +-----------+------------+--------------------
  |Covers:     CPAP-SG320X CPSB-FW CPSM-C-2 CPSB-VPN CPSB-NPM CPSB-LOGS CPSB-IA CPSB-SSLVPN-5 CPSB-ADNC CPSB-IPS-S1 CPSB-URLF CPSB-ABOT CPSB-APC
L CPSB-ASPM CPSB-AV CPSB-CTNT
===+===========+============+====================
2    | 1May2023 | CPSB-EBP-URLF
  +-----------+------------+--------------------
  |Covers:     CPAP-SG320X CPSB-FW CPSM-C-2 CPSB-VPN CPSB-NPM CPSB-LOGS CPSB-IA CPSB-SSLVPN-5 CPSB-ADNC CPSB-IPS-S1 CPSB-URLF CPSB-ABOT CPSB-APC
L CPSB-ASPM CPSB-AV CPSB-CTNT
===+===========+============+====================
3 | 1May2023 | CPSB-EBP-TEX
  +-----------+------------+--------------------
  |Covers:     CPAP-SG320X CPSB-FW CPSM-C-2 CPSB-VPN CPSB-NPM CPSB-LOGS CPSB-IA CPSB-SSLVPN-5 CPSB-ADNC CPSB-IPS-S1 CPSB-URLF CPSB-ABOT CPSB-APC
L CPSB-ASPM CPSB-AV CPSB-CTNT
===+===========+============+====================
4 | 1May2023 | CPSB-EBP-CTNT
  +-----------+------------+--------------------
  |Covers:     CPAP-SG320X CPSB-FW CPSM-C-2 CPSB-VPN CPSB-NPM CPSB-LOGS CPSB-IA CPSB-SSLVPN-5 CPSB-ADNC CPSB-IPS-S1 CPSB-URLF CPSB-ABOT CPSB-APC
L CPSB-ASPM CPSB-AV CPSB-CTNT
===+===========+============+====================
5   | 1May2023 | CPSB-EBP-ABOT
  +-----------+------------+--------------------
  |Covers:     CPAP-SG320X CPSB-FW CPSM-C-2 CPSB-VPN CPSB-NPM CPSB-LOGS CPSB-IA CPSB-SSLVPN-5 CPSB-ADNC CPSB-IPS-S1 CPSB-URLF CPSB-ABOT CPSB-APC
L CPSB-ASPM CPSB-AV CPSB-CTNT
===+===========+============+====================
6    | 1May2023 | CPES-SS-PREMIUM-ADD
  +-----------+------------+--------------------
  |Covers:     CPAP-SG320X CPSB-FW CPSM-C-2 CPSB-VPN CPSB-NPM CPSB-LOGS CPSB-IA CPSB-SSLVPN-5 CPSB-ADNC CPSB-IPS-S1 CPSB-URLF CPSB-ABOT CPSB-APC
L CPSB-ASPM CPSB-AV CPSB-CTNT
===+===========+============+====================
7 | 1May2023 | CPSB-EBP-IPS
  +-----------+------------+--------------------
  |Covers:     CPAP-SG320X CPSB-FW CPSM-C-2 CPSB-VPN CPSB-NPM CPSB-LOGS CPSB-IA CPSB-SSLVPN-5 CPSB-ADNC CPSB-IPS-S1 CPSB-URLF CPSB-ABOT CPSB-APC
L CPSB-ASPM CPSB-AV CPSB-CTNT
===+===========+============+====================
8 | 1May2023 | CPSB-EBP-ASPM
  +-----------+------------+--------------------
  |Covers:     CPAP-SG320X CPSB-FW CPSM-C-2 CPSB-VPN CPSB-NPM CPSB-LOGS CPSB-IA CPSB-SSLVPN-5 CPSB-ADNC CPSB-IPS-S1 CPSB-URLF CPSB-ABOT CPSB-APC
L CPSB-ASPM CPSB-AV CPSB-CTNT
===+===========+============+====================
9 | 1May2023 | CPSB-EBP-APCL
  +-----------+------------+--------------------
  |Covers:     CPAP-SG320X CPSB-FW CPSM-C-2 CPSB-VPN CPSB-NPM CPSB-LOGS CPSB-IA CPSB-SSLVPN-5 CPSB-ADNC CPSB-IPS-S1 CPSB-URLF CPSB-ABOT CPSB-APC
L CPSB-ASPM CPSB-AV CPSB-CTNT
===+===========+============+====================
10   | 16May2017 | CPSB-IPS-S1-1Y
  +-----------+------------+--------------------
  |Covers:     CPAP-SG320X CPSB-FW CPSM-C-2 CPSB-VPN CPSB-NPM CPSB-LOGS CPSB-IA CPSB-SSLVPN-5 CPSB-ADNC CPSB-IPS-S1 CPSB-URLF CPSB-ABOT CPSB-APC
L CPSB-ASPM CPSB-AV CPSB-CTNT
===+===========+============+====================
11 | 1May2023 | CPSB-EBP-AV
  +-----------+------------+--------------------
  |Covers:     CPAP-SG320X CPSB-FW CPSM-C-2 CPSB-VPN CPSB-NPM CPSB-LOGS CPSB-IA CPSB-SSLVPN-5 CPSB-ADNC CPSB-IPS-S1 CPSB-URLF CPSB-ABOT CPSB-APC
L CPSB-ASPM CPSB-AV CPSB-CTNT
===+===========+============+====================

Re: IPS not enabled but still receiving notice of expired blade

the_rock — Mon, 21 Aug 2023 17:31:54 GMT

Technically, you could delete one from May of this year, I believe command is cplic del CK-whatever ck number is

Or detach it from smart update

But, just to be sure 100%, I would still confirm with License folks.

Even after 16 years, I still dont understand CP licensing...if I was to live 1000 years, that would never change lol

Andy

Re: IPS not enabled but still receiving notice of expired blade

Tony_Graham — Mon, 21 Aug 2023 17:35:05 GMT

'Even after 16 years, I still dont understand CP licensing...if I was to live 1000 years, that would never change lol'

Diddo, except I have 27 years dealing with it. It never gets better.

Re: IPS not enabled but still receiving notice of expired blade

the_rock — Mon, 21 Aug 2023 17:36:12 GMT

I dont disagree with you mate, meaning, I AGREE : - )

Re: IPS not enabled but still receiving notice of expired blade

the_rock — Mon, 21 Aug 2023 17:39:30 GMT

By the way @Tony_Graham

I find that method cplic del the best, girl from Account services always uses that, cant recall name now, in my opinion, she is the best there, very patient and does not give up until issue is solved.

Andy

Re: IPS not enabled but still receiving notice of expired blade

Tony_Graham — Mon, 21 Aug 2023 17:41:02 GMT

I think I've worked with her before as well. 5 star service.

Re: IPS not enabled but still receiving notice of expired blade

the_rock — Mon, 21 Aug 2023 17:42:57 GMT

Madison, thats it...she is the best, in my opinion. Hope she gets some sort of recognition if anyone from her department sees this discussion.

Andy

Re: IPS not enabled but still receiving notice of expired blade

Tony_Graham — Wed, 30 Aug 2023 16:37:00 GMT

Quick synopsis of the eventual resolution. Alerts changed in Smart Console after updating to 81.20. Red X stayed on errant device but Yellow alerts appeared on main firewall. As I don't have to alert message detail, I am going on memory which isn't great anymore, but as I recall it was something related to IPS again but on the main firewall. Something in the message made me decide to alter the IPS on main firewall. I switched it to Autonomous. I had been running it with everything on except Threat Extraction (for another reason) but thought I would give Autonomous a go. When I went to push policy I got a message that certain devices were scheduled for uninstall of IPS. Hmmm, I thought. As the retired firewall had not had policy pushed to it in awhile, I enabled it for policy push and let her rip. That cured both alerts on the main firewall and fixed the red X on the retired unit. This path of repair did not present itself until 81.20 was installed.