topic Re: Unable to install policy on gateway in Firewall and Security Management

Unable to install policy on gateway

Neuromancer — Thu, 05 Oct 2023 14:27:09 GMT

Hello,

I am trying to test CloudGuard deployment along with Gateway Load Balancer in AWS environment. I am following this guide

I have subsribed my account to:

Check Point Security Management - R80.40

CloudGuard Network Security for Gateway Load Balancer - R81.20

which seems to provide "Free trial" and I believe this is my only option to test and try the product. Please correct me if I am wrong.

When I deploy using the provided cloud formation template, I am unable to install any policy on the gateway.

The initial one (autoprovisioned) is failing right after the start of both of the appliances.

The message I got from the SmartConsole and /var/log/CPcme/cme.log is: no valid licenses installed on the gateway.

In addition - I don't see healthy targets in the target group for the GWLB. The reason is obvious - health checks are failing - port 8117.

Should I install any policy to have these checks completed successfully? If yes - why I am unable to?

In addition I don't see anything listening to 6081 - GENEVE.

Any help will be greatly appreciated.

Re: Unable to install policy on gateway

Chris_Atkinson — Thu, 05 Oct 2023 15:39:07 GMT

Note an R80.40 management server cannot manage an R81.20 gateway.

Re: Unable to install policy on gateway

the_rock — Thu, 05 Oct 2023 15:54:15 GMT

Chris is 100% right, you need to fix that first. Rule of thumb for any fw platform out there is that management entity HAS TO be equal OR higher version than gateways managed by it (in CP case, jumbo hotfix does not matter though).

Once you fix that, if it still fails, we can help you further.

Andy

Re: Unable to install policy on gateway

Neuromancer — Fri, 06 Oct 2023 17:06:13 GMT

I have mixed the versions mentioned. It is actually the opposite:

Check Point Security Management - R81.20

CloudGuard Network Security for Gateway Load Balancer - R80.40

Sorry for the confusion caused.

Re: Unable to install policy on gateway

the_rock — Sun, 08 Oct 2023 21:52:33 GMT

K, fair enough. If its telling you no valid licences, you can, just temporarily, put on local eval licenses good for 30 days. Also, if its complaining about port 8117, maybe check below.

Andy

https://community.checkpoint.com/t5/Cloud-Network-Security/Azure-cloudguard-VMSS-health-probes-on-8117-and-monitor/m-p/141582/thread-id/1254#M1262

Re: Unable to install policy on gateway

Neuromancer — Tue, 17 Oct 2023 07:51:52 GMT

Hello,

It appeared that - it is not so simple to subscribe in market place on AWS and to expect everything to work. Despite the fact - that I had free trial and I use the exact AMI in question, it is still complaining about valid licenses. After several conversations with the support and case opened with them - it seems that I need to contact my local sales representative.

What we just wanted is to deploy and test the product - which happens to be not so intuitive...

Re: Unable to install policy on gateway

_Val_ — Tue, 17 Oct 2023 08:32:48 GMT

Show "cplic print" output from both management and GW, please

Re: Unable to install policy on gateway

Chris_Atkinson — Tue, 17 Oct 2023 08:53:23 GMT

Are they BYOL or PAYG instances...

Besides the 14-day PNP license, typically there are two flavors that might apply for BYOL depending on how you deployed. Specifically evaluation licenses are available via self-service here: Product Evaluation (checkpoint.com)

The choices are:

- All-in-one eval

- Other > Vsec CloudGuard (VE)

Re: Unable to install policy on gateway

the_rock — Tue, 17 Oct 2023 10:16:48 GMT

I know for a fact that recommended way of deploying licenses in the cloud when it comes to CP is central method, BUT, local works as well, as I tested it. Now, as Val asked, if we could see output of cplic print, it will give us a better idea.

Andy

Re: Unable to install policy on gateway

Neuromancer — Tue, 17 Oct 2023 12:59:31 GMT

Management:

[Expert@mgmt-aws:0]# cplic print
Host Expiration Features
1.1.1.1 never CPSM-C-25 CPSM-NGSM CPSB-WKFL-25 CPSB-NPM CPSB-EPM CPSB-LOGS CPSB-MNTR CPSB-MPTL CPSB-UDIR CPSB-PRVS CPSB-COMP-25 CPSB-SME-25 CPSB-RPRT-N-C2500 CK-D4-9A-20-EF-C5-04

Contract Coverage:

# ID Expiration SKU
===+===========+============+====================
1 | S2R3W9Q | 1Sep2034 | CPSB-EVNT-25-1Y
+-----------+------------+--------------------
|Covers: CPSM-C-25 CPSM-NGSM CPSB-WKFL-25 CPSB-NPM CPSB-EPM CPSB-LOGS CPSB-MNTR CPSB-MPTL CPSB-UDIR CPSB-PRVS CPSB-COMP-25 CPSB-SME-25 CPSB-RPRT-N-C2500 CK-D4-9A-20-EF-C5-04
===+===========+============+====================
2 | D16DWGE | 1Sep2034 | CPSB-COMP-25-1Y
+-----------+------------+--------------------
|Covers: CPSM-C-25 CPSM-NGSM CPSB-WKFL-25 CPSB-NPM CPSB-EPM CPSB-LOGS CPSB-MNTR CPSB-MPTL CPSB-UDIR CPSB-PRVS CPSB-COMP-25 CPSB-SME-25 CPSB-RPRT-N-C2500 CK-D4-9A-20-EF-C5-04
===+===========+============+====================
3 | 1336IG2 | 1Sep2034 | CPSB-RPRT-25-1Y
+-----------+------------+--------------------
|Covers: CPSM-C-25 CPSM-NGSM CPSB-WKFL-25 CPSB-NPM CPSB-EPM CPSB-LOGS CPSB-MNTR CPSB-MPTL CPSB-UDIR CPSB-PRVS CPSB-COMP-25 CPSB-SME-25 CPSB-RPRT-N-C2500 CK-D4-9A-20-EF-C5-04
===+===========+============+====================
4 | F0Y2F25 | 1Sep2034 | CPES-SS-STANDARD-ADD
+-----------+------------+--------------------
|Covers: CPSM-C-25 CPSM-NGSM CPSB-WKFL-25 CPSB-NPM CPSB-EPM CPSB-LOGS CPSB-MNTR CPSB-MPTL CPSB-UDIR CPSB-PRVS CPSB-COMP-25 CPSB-SME-25 CPSB-RPRT-N-C2500 CK-D4-9A-20-EF-C5-04
===+===========+============+====================

On the gateway itself says it is a deprecated command.

Re: Unable to install policy on gateway

Neuromancer — Tue, 17 Oct 2023 13:00:53 GMT

PAYG . This was looking the only viable option, because it seems to provide free trial.

Re: Unable to install policy on gateway

Chris_Atkinson — Tue, 17 Oct 2023 13:03:31 GMT

Strange PAYG should have the license baked in, that's the whole idea of it

Re: Unable to install policy on gateway

Neuromancer — Tue, 17 Oct 2023 13:05:13 GMT

Of course - that's was initially my expectations. And this was a little bit disappointing 🙂

Re: Unable to install policy on gateway

the_rock — Tue, 17 Oct 2023 14:04:55 GMT

Have you tested with LOCAL eval license?

Andy

Re: Unable to install policy on gateway

Neuromancer — Tue, 17 Oct 2023 14:21:54 GMT

I am not really sure what this means... From where should I get this license? I know for sure that I got some licenses while checking them via SmartConsole - and they appeeared to be on the device itself. Please note, that I am installing with PAYG from AWS Marketplace. I don't have any other licenses, nor do I know from where to get them.

We tried several things with support guys, including manually installing contract files and licenses. None of them worked so far. In addition it is still not clear for me how this instances are getting licensed, having in mind that in AWS they are running in autoscalling group which dynamically resize itself. For me - it is logical the instances itself to have embedded trial licenses or the management server is used as a dynamic distributor for the licenses.

Re: Unable to install policy on gateway

Chris_Atkinson — Tue, 17 Oct 2023 15:42:17 GMT

Is Management R81.20 JHF T26 and is CME up to date?

Being a GWLB deployment what was the rationale for the gateway being R80.40 vs R81.20?

Re: Unable to install policy on gateway

the_rock — Tue, 17 Oct 2023 19:09:00 GMT

Message me directly with IP addresses and I will get them for you.

Re: Unable to install policy on gateway

Neuromancer — Wed, 18 Oct 2023 05:21:39 GMT

Thank you for you help, I have a meeting with local sales representative and I expect a possitive result.

I will let you know for sure.

Re: Unable to install policy on gateway

Support-Team_Cr — Wed, 18 Oct 2023 10:56:44 GMT

Hi @Neuromancer,

The CME checks the licence on the management server. In the case of a PAYG, you must transfer the licence from Gateway to the Management Server.

Try the following steps:
1) Start Smart Console and open SmartUpgrade
2) Now get the license from Gateway

Once the licence has been imported to the management server, everything should work.

Re: Unable to install policy on gateway

Neuromancer — Wed, 18 Oct 2023 11:27:04 GMT

Believe it or not - NO ONE so far has told me that the licenses are based on IP addresses on the management interfaces.

And in case I want to try the product - I just need an account in user center and generate license myself.

We followed the link provided along with sales support and I actually manage to generate licenses and then assign them to the appropriate instances.

However, it is still confusing how the gateways being part of the ASG will get licensed in a prod environment , having in mind that autoscalling group will terminate and start instances based on the load.