topic Re: URL and Application blade issues in Firewall and Security Management

URL and Application blade issues

Martin_Valenta — Wed, 24 Apr 2019 07:10:23 GMT

We had issues with app control and url filtering blade today and this fixed our issues per recommendation from TAC..

cd $FWDIR/appi/update/
curl_cli -O http://secureupdates.checkpoint.com/appi/v4_0_1/gw/appi_db.C.tmp
mv appi_db.C.tmp appi_db.C
fw load_sigs

Re: URL and Application blade issues

Vato_Chantladze — Wed, 24 Apr 2019 09:06:46 GMT

Hi!

This started yesterday. I saw this issue customers running on R80.10

Support should give you valid appi db file and after this is recommendation to move it to current one:

1. Download the following file: appi_db.C.tmp

2. Copy it on the gw to: $FWDIR/appi/update/

3. Rename it to appi_db.C

4. Load signatures with “fw load_sids”

Vato

Re: URL and Application blade issues

Shahar_Grober — Wed, 24 Apr 2019 09:43:50 GMT

What did it effect exactly,

we had a problem with SMTP over TLS which Check Point started to drop yesterday afternoon without any clear reason

Re: URL and Application blade issues

Martin_Valenta — Wed, 24 Apr 2019 09:45:12 GMT

It basically didn't match anything on application layer policies, everything got dropped on clean up rule..

Re: URL and Application blade issues

Vato_Chantladze — Wed, 24 Apr 2019 10:06:17 GMT

The same here. Everything as you described.

If you restart the firewall it will block all the traffic. You need to change db file without reboot

Re: URL and Application blade issues

Shahar_Grober — Wed, 24 Apr 2019 10:11:55 GMT

I just talked to support

you can verify the issue with the following command:

grep -i appi_app_db_get_app_log_data /var/log/messages*

and get

"pp_db_get_app_log_data: failed getting application object from hash"

Nasty bug!!!

Does it occur only in R80.10 or also other versions?

Re: URL and Application blade issues

LukeOxley — Tue, 31 Mar 2020 21:10:58 GMT

The fix has worked for us - has anyone verified if a reboot / policy install overwrites the fix?

Re: URL and Application blade issues

Peter_Lyndley — Wed, 24 Apr 2019 10:23:43 GMT

We have only seen it on r80.10 in our customers estates at the moment.

Does a policy push then overwrite these values/files ? or are we safe to carry on as normal once the TAC workaround is in place?

thanks

Peter

Re: URL and Application blade issues

Vato_Chantladze — Wed, 24 Apr 2019 10:46:14 GMT

So far I saw only R80.10 with automatic updates enabled on the gateway side.

There is no sk for this. support center should create it for other customers as soon as possible. It is not a lite bug it makes a big problem to the production environment

BR
Vato

Re: URL and Application blade issues

Mor_Himi — Wed, 24 Apr 2019 11:02:17 GMT

Hi All,

The issue has been resolved ~15 hours ago.

No need for manual overrides or turning off Automatic Updates.

Thanks...

--Mor

Re: URL and Application blade issues

Mor_Himi — Wed, 24 Apr 2019 11:07:17 GMT

Hi Shahar,

nice seeing you here 🙂
The issue has been resolved yesterday IL time, can you update if if suffer form this now?
Thanks...
--Mor

Re: URL and Application blade issues

Mor_Himi — Wed, 24 Apr 2019 11:09:15 GMT

Hi Martin,

Can you re-enable online update and reply if the issue has been resolved for you?

Thanks...

--Mor

Re: URL and Application blade issues

Mor_Himi — Wed, 24 Apr 2019 11:12:32 GMT

Hi Vato,

Can you please enable online online update and clarify if the issue has been resolved for you?

There is no need to apply any workarounds any this phase.

Thanks....

--Mor

Re: URL and Application blade issues

Vato_Chantladze — Wed, 24 Apr 2019 11:15:13 GMT

In our case, we tried to turn-off turn-on automatic updates but it was not getting it. Only db replacement is solving it.

Re: URL and Application blade issues

Martin_Valenta — Wed, 24 Apr 2019 11:16:45 GMT

I didn't disable auto updates, i just applied fix and afterwards it started to work again..

Re: URL and Application blade issues

Mor_Himi — Wed, 24 Apr 2019 11:16:46 GMT

Can you please share the output of:

cat $FWDIR/appi/update/Version

Re: URL and Application blade issues

Martin_Valenta — Wed, 24 Apr 2019 11:18:30 GMT

cat $FWDIR/appi/update/Version
(
:pkg_file_name ("appi_urlf_db_pkg.tar")
:md5sum ("fc4ceae34aecb0394c17109687dcff1a")
:pkg_version (240419_3)
:appi_version ("140419_1")
:urlf_version ("240419_3")
:pkg_timestamp (1556091487)
:appi_filename ("appi_db.C.tmp")
:urlf_filename ("urlf_db.bin.tmp")

Re: URL and Application blade issues

Mor_Himi — Wed, 24 Apr 2019 11:22:15 GMT

10x, looking great.

Any pkg version => 240419_1 (yours is 240419_3) should work without any issues.

Re: URL and Application blade issues

Martin_Valenta — Wed, 24 Apr 2019 11:22:26 GMT

@Mor_Himi shoulnd't be here https://status.checkpoint.com/ any sort of note ?

Re: URL and Application blade issues

Mor_Himi — Wed, 24 Apr 2019 11:27:58 GMT

Good question.

Since the issue and its resolution didn't involve any of our cloud services it doesn't seem like the correct place.

I will however check internally how best to communicate such incidents going forward.