topic Object default icmp-proto not found in Firewall and Security Management

Object default icmp-proto not found

Danilo_Silva — Tue, 12 Jun 2018 14:41:45 GMT

Hi, everyone, After migrating an MDS from 77.30 to 80.10 we identified that an icmp-proto object could not be located, but when we try to create an object with that name, I get the information that the object already exists. When opening dbEdit I locate the object and I can change it but when I save I receive the message that the object was not found. I tried to find the same object in other CMA's and it did not succeed either. Has anyone had the same problem?

Re: Object default icmp-proto not found

Danny — Tue, 12 Jun 2018 14:50:38 GMT

It's still there:

Re: Object default icmp-proto not found

Danilo_Silva — Tue, 12 Jun 2018 15:28:56 GMT

Not in my case:

Re: Object default icmp-proto not found

Danny — Tue, 12 Jun 2018 15:37:19 GMT

Compare the screenshots. You searched for Services, I searched for All.

Re: Object default icmp-proto not found

Danilo_Silva — Tue, 12 Jun 2018 16:12:29 GMT

anyway not show

Re: Object default icmp-proto not found

Vincent_Bacher — Tue, 12 Jun 2018 16:32:48 GMT

I'd suggest to log a ticket at Checkpoint TAC.

Re: Object default icmp-proto not found

Kaspars_Zibarts — Tue, 12 Jun 2018 19:44:59 GMT

Not too sure if it helps. Mine work fine in all CMAs. But you might want to compare all properties if you see object with dbedit

dbedit> print services icmp-proto

Object Name: icmp-proto
Object UID: {97AEB405-9AEA-11D5-BD16-0090272CCB30}
Class Name: other_service
Table Name: services
Last Modified by: System
Last Modified from: localhost
Last Modification time: Fri Mar 17 10:28:22 2017
Fields Details
--------------
action_exp:
aggressive_aging_timeout: 15
color: dark orchid
comments: Internet Control Message Protocol
default_aggressive_aging_timeout: 0
enable_aggressive_aging: true
etm_enabled: true
has_detect: false
include_in_any: true
is_default_aggressive_timeout: true
match_exp:
needruleinfo: false
no_mapping_for_exp: false
port:
prohibit_aggressive_aging: false
proto_type: NULL
protocol: 1
protocol_uuid:
reload_proof: false
replies: false
service_port_type: customize
sync_on_cluster: true
timeout: 60
type: other
unsupported_compatibility_packages:
updated_by_sd: false
use_default_session_timeout: true
weight: 0

and from API call

> show service-other name "icmp-proto" details-level full

uid: "97aeb405-9aea-11d5-bd16-0090272ccb30"
name: "icmp-proto"
type: "service-other"
domain:
uid: "a0bbbc99-adef-4ef8-bb6d-defdefdefdef"
name: "Check Point Data"
domain-type: "data domain"
ip-protocol: 1
accept-replies: false
override-default-settings: false
session-timeout: 60
use-default-session-timeout: true
match-for-any: true
sync-connections-on-cluster: true
aggressive-aging:
enable: true
timeout: 15
use-default-timeout: true
default-timeout: 0
keep-connections-open-after-policy-installation: false
groups:
- uid: "f8568c62-b8aa-4d90-9ec6-534eaa1b71db"
name: "Restrict_Common_Protocols_Action"
type: ""
domain:
uid: "7e1db45a-8f27-4358-bf5b-65b13e15764f"
name: "blablabla"
domain-type: "domain"
color: "black"
meta-info:
validation-state: "ok"
last-modify-time:
posix: 1517837041917
iso-8601: "2018-02-05T14:24+0100"
last-modifier: "System"
creation-time:
posix: 1517837041917
iso-8601: "2018-02-05T14:24+0100"
creator: "System"
tags: []
icon: "Unknown"
comments: "Restrict to common protocols and Trusted Zone"
display-name: ""
customFields: null
comments: "Internet Control Message Protocol"
color: "orchid"
icon: "Services/OtherService"
tags: []
meta-info:
lock: "unlocked"
validation-state: "ok"
last-modify-time:
posix: 1489742902848
iso-8601: "2017-03-17T10:28+0100"
last-modifier: "System"
creation-time:
posix: 1489742902848
iso-8601: "2017-03-17T10:28+0100"
creator: "System"
read-only: false

Re: Object default icmp-proto not found

Danilo_Silva — Tue, 12 Jun 2018 20:01:32 GMT

Hi, Kaspars Zibarts‌ in your case was upgraded from 77.30 to 80.10?

Re: Object default icmp-proto not found

Danilo_Silva — Tue, 12 Jun 2018 20:04:03 GMT

> show service-other name "icmp-proto" details-level full

code: "generic_err_object_not_found"
message: "Requested object [icmp-proto] not found"

Re: Object default icmp-proto not found

Kaspars_Zibarts — Tue, 12 Jun 2018 20:05:42 GMT

what about dbedit?

Re: Object default icmp-proto not found

Danilo_Silva — Tue, 12 Jun 2018 20:15:06 GMT

In the dbedit are exactly same ...

Re: Object default icmp-proto not found

Danilo_Silva — Tue, 12 Jun 2018 20:17:08 GMT

Object Name: icmp-proto
Object UID: {97AEB405-9AEA-11D5-BD16-0090272CCB30}
Class Name: other_service
Table Name: services
Last Modified by: System
Last Modified from: localhost
Last Modification time: Sat May 26 17:14:18 2018
Fields Details
--------------
action_exp:
aggressive_aging_timeout: 15
color: dark orchid
comments: Internet Control Message Protocol
default_aggressive_aging_timeout: 0
enable_aggressive_aging: true
etm_enabled: true
has_detect: false
include_in_any: true
is_default_aggressive_timeout: true
match_exp:
needruleinfo: false
no_mapping_for_exp: false
port:
prohibit_aggressive_aging: false
proto_type: NULL
protocol: 1
protocol_uuid:
reload_proof: false
replies: false
service_port_type: customize
sync_on_cluster: true
timeout: 60
type: other
unsupported_compatibility_packages:
updated_by_sd: false
use_default_session_timeout: true
weight: 0

Re: Object default icmp-proto not found

Kaspars_Zibarts — Tue, 12 Jun 2018 21:43:20 GMT

Actually no. 77.30 to 80 originally. Then 80.10. but we had some object conflicts that we were able to resolve with dbedit.

Re: Object default icmp-proto not found

Tomer_Sole — Wed, 13 Jun 2018 05:55:28 GMT

Indeed, please open a support ticket. The service should be there.