topic Re: IPS issue (R80.20) - cannot remove IPS blade from GW object in Firewall and Security Management

IPS issue (R80.20) - cannot remove IPS blade from GW object

Jerry — Tue, 30 Apr 2019 10:38:39 GMT

hi chaps

got an interesting one

1. object of the GW has IPS enabled, when trying to untick and disable it I cannot seem to save the changes as SmartConsole shout on me as following:

a. "Failed to save object "xxx". A blocking validation error was found: Field InstallTargetIds references invalid object

b. "The current changes to object "xxx" parameters are invalid and therefore will be discarded"

and that's all. when "a" occur the only way to move on is to click OK, when done "b" appears.

any idea what and why? literally nothnig has changed on that "StandAlone" Appliance since original install of R80.20.

ps. cpinfo -y all below (also see enclosed 1.png)

[Expert@xxx:0]# cpinfo -y all

This is Check Point CPinfo Build 914000190 for GAIA
[IDA]
No hotfixes..

[CPFC]
HOTFIX_R80_20_JUMBO_HF_MAIN Take: 47
BUNDLE_R80_20_JUMBO_HF_MAIN_SC

[MGMT]
HOTFIX_R80_20_JUMBO_HF_MAIN Take: 47
BUNDLE_R80_20_JUMBO_HF_MAIN_SC

[FW1]
HOTFIX_R80_20_JUMBO_HF_MAIN Take: 47
BUNDLE_R80_20_JUMBO_HF_MAIN_SC

FW1 build number:
This is Check Point Security Management Server R80.20 - Build 007
This is Check Point's software version R80.20 - Build 047
kernel: R80.20 - Build 047

[SecurePlatform]
HOTFIX_R80_20_JUMBO_HF_MAIN Take: 47
BUNDLE_R80_20_JUMBO_HF_MAIN_SC

[CPinfo]
No hotfixes..

[DIAG]
No hotfixes..

[PPACK]
HOTFIX_R80_20_JUMBO_HF_MAIN Take: 47
BUNDLE_R80_20_JUMBO_HF_MAIN_SC

[CVPN]
HOTFIX_R80_20_JUMBO_HF_MAIN Take: 47
BUNDLE_R80_20_JUMBO_HF_MAIN_SC

[SmartLog]
No hotfixes..

[Reporting Module]
HOTFIX_R80_20_JUMBO_HF_MAIN Take: 47
BUNDLE_R80_20_JUMBO_HF_MAIN_SC

[CPuepm]
HOTFIX_R80_20_JUMBO_HF_MAIN Take: 47
BUNDLE_R80_20_JUMBO_HF_MAIN_SC

[VSEC]
HOTFIX_R80_20_JUMBO_HF_MAIN Take: 47
BUNDLE_R80_20_JUMBO_HF_MAIN_SC

[R7520CMP]
No hotfixes..

[R7540CMP]
No hotfixes..

[R76CMP]
No hotfixes..

[SFWR77CMP]
No hotfixes..

[R77CMP]
HOTFIX_R80_20_JHF_COMP Take: 47
BUNDLE_R80_20_JUMBO_HF_MAIN_SC

[R75CMP]
No hotfixes..

[NGXCMP]
No hotfixes..

[EdgeCmp]
No hotfixes..

[SFWCMP]
No hotfixes..

[FLICMP]
No hotfixes..

[SFWR75CMP]
No hotfixes..

[MGMTAPI]
No hotfixes..

[CPUpdates]
BUNDLE_CPINFO Take: 0
BUNDLE_R80.20_SC Take: 101
BUNDLE_R80_20_JUMBO_HF_MAIN Take: 47
BUNDLE_R80_20_JUMBO_HF_MAIN_SC Take: 73

Re: IPS issue (R80.20) - cannot remove IPS blade from GW object

Tal_Paz-Fridman — Tue, 30 Apr 2019 11:14:04 GMT

Hi Jerry,

Please go over the Threat Prevention Policy rules [Security Policies > Threat Prevention > Each Threat Prevention Layer] and make sure the Security Gateway with the IPS blade is not directly selected as an Install On target.

If it is, try changing the Install On for each rule so that it is * Policy Targets and then try disabling the IPS blade.

HTH

Tal

Re: IPS issue (R80.20) - cannot remove IPS blade from GW object

Wolfgang — Tue, 30 Apr 2019 11:28:47 GMT

Jerry,

we had the same problem last month.

As Tal_Paz-Fridman wrote, we removed the directly assigned gateway from the install target column adn now you can uncheck IPS from gateway properties.

Please too check your IPS exceptions, maybee there is too an direct assignment of the gateway.

Wolfgang

Re: IPS issue (R80.20) - cannot remove IPS blade from GW object

Jerry — Tue, 30 Apr 2019 11:47:13 GMT

see below Tal. I have never had here any "targets" selected though I don't think this applies to my case.

Now the GW has IPS blade enabled, and after the complete reboot of the GW all seems just fine:

I have really no clue why I couldn't "deselect" blade on GW object and save it 1h ago.

Re: IPS issue (R80.20) - cannot remove IPS blade from GW object

Wolfgang — Tue, 30 Apr 2019 12:25:33 GMT

Jerry,

that's magic. Maybee some earth rays or other things in the air are affecting the SMS..

I love our IT job, normally it consist of 0 and 1 but sometimes something between 8)

Wolfgang

Re: IPS issue (R80.20) - cannot remove IPS blade from GW object

TP_Master — Fri, 03 May 2019 06:23:52 GMT

Conclusion: Don't disable the IPS blade.

Why would you even want to do that? 🙂

Re: IPS issue (R80.20) - cannot remove IPS blade from GW object

Jerry — Fri, 03 May 2019 08:26:35 GMT

neva! 😛

Re: IPS issue (R80.20) - cannot remove IPS blade from GW object

Amit_Koren — Sun, 16 Feb 2020 08:24:16 GMT

I needed to disable IPS according to sk163752

I did not have a target in the Install On column of the Threat Prevention policy.

For me, the issue was that the gateway was selected under automatic install after IPS update.

I had to remove the gateway, install database and only then i could uncheck the IPS blade.

Re: IPS issue (R80.20) - cannot remove IPS blade from GW object

Tony_Graham — Mon, 15 May 2023 19:52:33 GMT

I am also having problems disabling IPS. Exactly the same situation as the original poster.

Re: IPS issue (R80.20) - cannot remove IPS blade from GW object

the_rock — Mon, 15 May 2023 19:56:08 GMT

I remember one time I had this problem ages ago, I changed something in Guidbedit to make it work, but it was more than 10 years ago, so definitely before R80 version. Can you send a screenshot?

Andy

Re: IPS issue (R80.20) - cannot remove IPS blade from GW object

Tony_Graham — Mon, 15 May 2023 20:10:29 GMT

Re: IPS issue (R80.20) - cannot remove IPS blade from GW object

the_rock — Mon, 15 May 2023 20:19:38 GMT

I found some posts where it says to remove scheduled ips updates (if enabled) and also remove from here, IF its enabled

Andy

Re: IPS issue (R80.20) - cannot remove IPS blade from GW object

Tony_Graham — Mon, 15 May 2023 21:14:12 GMT

I don't have anything under Install On other than 'Policy Targets'. Nothing specific. I unchecked IPS updates and now the entire dialog for IPS updates is gone (edit: It seems it changed the focus from Threat Prevention to Updates which is why it disappeared. I had to click back on Threat Prevention>Updates to get back to where I was.)

Re: IPS issue (R80.20) - cannot remove IPS blade from GW object

Tony_Graham — Mon, 15 May 2023 21:14:47 GMT

I have a Geo Policy defined but there is no way to tell it NOT to install on this device I am trying to remove IPS from without impacting the device I don't want to. I can 'view' the items under Gateways but you cannot manipulate them. So you cannot really say, hey don't push Geo Policy to X device, at least I don't know how you would do that. I believe Geo Policy is a part of IPS so that could be what is stopping it from being deactivated.

Re: IPS issue (R80.20) - cannot remove IPS blade from GW object

Timothy_Hall — Mon, 15 May 2023 21:29:12 GMT

Right-click on the gateway object and select "Where Used". That should help you figure out where the reference to that object is that is blocking you. My guess is you are referencing that particular gateway for "Install On" in a custom Threat Prevention rule, IPS ThreatCloud exception or possibly even a Core Activations exception.

Geo Policy is not part of IPS starting in R80 (and this feature is now deprecated) but there still may be some remaining hooks to IPS here as I sometimes still notice references to IPS in the logs for Geo Policy drops.

Re: IPS issue (R80.20) - cannot remove IPS blade from GW object

the_rock — Mon, 15 May 2023 21:33:59 GMT

I think what @Timothy_Hall gave makes total sense. Follow those instructions and let us know what gives.

Andy

Re: IPS issue (R80.20) - cannot remove IPS blade from GW object

Tony_Graham — Mon, 15 May 2023 21:56:26 GMT

Under Objects there was IPS Scheduled Update. I had tried fussing with that earlier based on what Andy suggested,

so I went back and revisited it. I toggled it to 'install on specific' and 'back to Install' on all clicked okay.

Went back and tried to disable IPS and this time it worked. Yay team.

Re: IPS issue (R80.20) - cannot remove IPS blade from GW object

the_rock — Mon, 15 May 2023 21:55:57 GMT

Good job @Tony_Graham 💪💪

Re: IPS issue (R80.20) - cannot remove IPS blade from GW object

Tony_Graham — Mon, 15 May 2023 21:59:30 GMT

So I have an unrelated, related question. If you push a policy that contains IPS, for instance you shotgun out a policy to all gateways, does CP know that since the blade isn't running on that device to just drop the rules or does it get the whole policy but just ignores the bits it cannot enforce. Is there a benefit to pushing different policies since the ruleset would be less complicated?

Re: IPS issue (R80.20) - cannot remove IPS blade from GW object

the_rock — Mon, 15 May 2023 22:08:41 GMT

Thats pretty much how it works for any blade, if blade is NOT active, rules will never apply.

Andy