topic Re: Smart Console Cannot log into R80.30 Management Server in Firewall and Security Management

Smart Console Cannot log into R80.30 Management Server

Nicholas_Moore — Wed, 19 Feb 2020 15:31:18 GMT

For the last several months my team has been unable to reliably log into Smart Console. We receive the following error messages:

"The operation timed out."

and

"An error occurred receiving the HTTP response to https://xxxxxxx/cpmws/LoginSvcRemote?wsdl. This could be due to the service endpoint binding not use the HTTP protocol. This could also be due to an HTTP request context being aborted by the server (possibly due to the service shutting down). See server logs for more details."

We have Diamond support. We have no answers. Has anyone else experienced anything like this? We have been locked out for minutes, hours and days at a time. There doesn't appear to be any urgency from support to get this resolved.

Re: Smart Console Cannot log into R80.30 Management Server

Nicholas_Moore — Wed, 19 Feb 2020 15:39:40 GMT

Does anyone know of tools that can export my Check Point obejcts and rules to Cisco or Palo Alto?

Re: Smart Console Cannot log into R80.30 Management Server

PhoneBoy — Thu, 20 Feb 2020 05:00:01 GMT

What's the hardware (cores, RAM) you're running management on?
Can you send me in PM ticket(s) you've opened on this?

Re: Smart Console Cannot log into R80.30 Management Server

Nicholas_Moore — Thu, 20 Feb 2020 14:19:12 GMT

Smart-1 5150 with 24 cores and 128GB RAM.

Re: Smart Console Cannot log into R80.30 Management Server

Timothy_Hall — Thu, 20 Feb 2020 15:58:04 GMT

Could possibly be a stability issue with fwm or cpm processes, what does cpwd_admin list say?

What are the specs of the SMS hardware?

Also check the health of your RAID setup (if applicable), and the underlying hard disks via /var/log/messages*. Also any hardware issues being noted by cpstat -f sensors os? Failing hardware can cause some strange effects that are hard to pin down.

Re: Smart Console Cannot log into R80.30 Management Server

Daniel_Schlifka — Fri, 21 Feb 2020 20:59:26 GMT

Hi,

you can use sk120342/sk64501 to export the policy-package as json/xml and then parse it and resolve policy and objects.
Then you can use a scripting language of your choice to translate the data to the required import format. Setup on PA/cisco side depends on how you want to deploy. For ssh you would just generate some batch files and install them chunkwise via copy and paste.

Re: Smart Console Cannot log into R80.30 Management Server

DH2019 — Thu, 23 Apr 2020 08:33:29 GMT

Hi,

I got the same problem. Did you solve it. Any idea?

But my hardware is 12400, standalone configuration.

Software -- R80.40.

Thanks

Paul

Re: Smart Console Cannot log into R80.30 Management Server

Markus_Genser — Thu, 23 Apr 2020 09:33:59 GMT

Hello!

I ran into this issue myself after a upgrade from R80.20 to R80.30 and installed jumbo 155.

A quick fix was after waiting and seeing the java process constantly on 20-40% CPU usage to perform a cprestart.

After this the SMS started correctly.

Have a look at the latest ongoing JHFA take with take 163 Check Point fixed following issue:

PRJ-3039,
PMTR-39305

Security Management

In some scenarios, the Management Server takes a long time to start or even fails to start.

Sadly no corresponding SK to verify the issue and I haven't yet installed the ongoing take.

Regards,

Markus

Re: Smart Console Cannot log into R80.30 Management Server

Markus_Genser — Thu, 23 Apr 2020 09:40:04 GMT

In addition to my previous post, the same ongoing take 163 fixes following issue:

PRJ-7413,
CPM-2541

Security Management

In a rare scenario, all users connected to the Management Server get disconnected and new logins fail until the Management Server is restarted.

Which sounds like the issue Nicholas_Moore was describing.