topic Re: Firemon and R81.10 in API / CLI Discussion

Firemon and R81.10

Raj_Khatri — Fri, 24 Jun 2022 13:07:32 GMT

We are running Firemon which is tied into our MDS running R80.40. After management was upgraded to R81.10, it has stopped working. Firemon logs are showing error when communicating with a particular firewall. The firewall listed should have no impact as it's retrieving data from the MDS/CMA.

Case already opened with both support teams and waiting to hear back. Just wondering if anyone else has faced the same issues recently... Thanks

[admin@server 10.x.x.x]$ fmos logview -Tf devpack.log
2022-06-24 12:41:41,950 1542853 [MainThread ] INFO fm.fwscripter: Logging in...
2022-06-24 12:41:41,950 1542853 [MainThread ] INFO fm.fwscripter: logging into domain: CMA
2022-06-24 12:41:41,950 1542853 [MainThread ] INFO fm.fwscripter: Executing login...
2022-06-24 12:41:41,950 1542853 [MainThread ] INFO fm.fwscripter: Attempt at login #1
2022-06-24 12:41:42,868 1542853 [MainThread ] INFO fm.fwscripter: Logged in.
2022-06-24 12:41:42,868 1542853 [MainThread ] INFO fm.fwscripter: Executing get publish data...
2022-06-24 12:41:42,868 1542853 [MainThread ] INFO fm.fwscripter: getting publish data
2022-06-24 12:41:42,868 1542853 [MainThread ] INFO fm.fwscripter: Executing show-last-published-session...
2022-06-24 12:41:42,962 1542853 [MainThread ] INFO fm.fwscripter: Executing get install data...
2022-06-24 12:41:42,963 1542853 [MainThread ] INFO fm.fwscripter: Executing show-gateways-and-servers...
2022-06-24 12:41:49,928 1542853 [MainThread ] INFO fm.fwscripter: Executing show-gateways-and-servers...
2022-06-24 12:41:51,686 1542853 [MainThread ] INFO fm.fwscripter: Domain is CMA
2022-06-24 12:41:51,687 1542853 [MainThread ] INFO fm.fwscripter: Executing run-script...
2022-06-24 12:41:53,253 1542853 [MainThread ] ERROR fm.fwscripter: error running command: run-script
2022-06-24 12:41:53,253 1542853 [MainThread ] ERROR fm.fwscripter: http status=404 content=b'{\n "code" : "generic_err_object_not_found",\n "message" : "Requested object [firewall] not found"\n}'
2022-06-24 12:41:53,253 1542853 [MainThread ] ERROR fm.fwscripter: An error occurred during retrieval: Please check logs for additional detail.
2022-06-24 12:41:53,253 1542853 [MainThread ] ERROR fm.fwscripter: http status=404 content=b'{\n "code" : "generic_err_object_not_found",\n "message" : "Requested object [firewall] not found"\n}'
2022-06-24 12:41:53,253 1542853 [MainThread ] ERROR fm.fwscripter: Traceback (most recent call last):
File "<string>", line 842, in retrieve_config
File "<string>", line 775, in gather_routes
File "<string>", line 61, in api_call
Exception: http status=404 content=b'{\n "code" : "generic_err_object_not_found",\n "message" : "Requested object [firewall] not found"\n}'

Re: Firemon and R81.10

PhoneBoy — Fri, 24 Jun 2022 18:47:38 GMT

Given the tool generating these errors is from Firemon, not sure Check Point TAC can assist with this.

Re: Firemon and R81.10

the_rock — Fri, 24 Jun 2022 19:14:46 GMT

I dealt with Firemon in my old job, but not for too long though. I will see if I can find some steps for you that could help. @PhoneBoy is right though...if those logs come from Firemon side, you may wish to check with them. I do find it a bit odd that issue happened after CP upgrade, so maybe worth checking CP logs as well.

Re: Firemon and R81.10

Raj_Khatri — Mon, 27 Jun 2022 12:31:47 GMT

I was able to see the same errors in the api.elg logs. Waiting on TAC to come back.

Thanks

Re: Firemon and R81.10

the_rock — Mon, 27 Jun 2022 12:43:59 GMT

I actually emailed a contact from Firemon (had their email from 5 years ago) and guy said he was not aware of any issues with R81.10 that they could find in their database, so keep us posted on what TAC says.

Re: Firemon and R81.10

_Val_ — Mon, 04 Jul 2022 10:00:04 GMT

I do not think TAC should be the first point of contact here. Third-party product fails after CP upgrade, this should be taken with Firemon first.

Re: Firemon and R81.10

the_rock — Tue, 05 Jul 2022 01:52:06 GMT

Well, considering this worked before the upgrade, logically it would indicate problem on CP side, but lets see...just my 2 cents.Looking forward to resolution from @Raj_Khatri .

Re: Firemon and R81.10

_Val_ — Tue, 05 Jul 2022 08:44:24 GMT

@the_rock sorry, but I strongly disagree. I have seen tons of cases where upgrading CP led to failure on the third party due to implementation mishaps, API changes, and other things that were not addressed by the third party vendor.

"If it worked before, it should work again" only applies to a single vendor implementation. If Firemon fails after CP upgrade, Firemon support should be the first point of contact. If they then said, take it with TAC, it is another matter.

Re: Firemon and R81.10

the_rock — Tue, 05 Jul 2022 10:31:36 GMT

@_Val_ ...every case is different. Im just going based on logic here, since person at Firemon I contacted said they were not aware of any compatibility issues with R81.10 version.

Anyway, lets see how it gets solved.

Re: Firemon and R81.10

_Val_ — Tue, 05 Jul 2022 10:56:10 GMT

The person you contacted is not familiar with the actual issue, and his general information may be incomplete.

Re: Firemon and R81.10

the_rock — Tue, 05 Jul 2022 11:30:53 GMT

Considering he is a senior tech and I showed him this link, I tend to disagree with that statement : - )

Re: Firemon and R81.10

_Val_ — Tue, 05 Jul 2022 14:32:44 GMT

I do not see a point to continue this discussion. Unless we have an official conclusion this is not a Firemon issue, I will stick to my opinion. Hearsay does not cut it.

That said, everyone has a right to a different point of view 🙂

Re: Firemon and R81.10

the_rock — Tue, 05 Jul 2022 15:05:43 GMT

I agree brother, I already moved on, no point spending time on trivial stuff : - )

Cheers.

Re: Firemon and R81.10

Raj_Khatri — Wed, 06 Jul 2022 11:21:20 GMT

Initially a support case was opened with Firemon and they found a case with another customer that faced the same issue and was resolved by Checkpoint TAC, but never received the root cause to log in their system. Hence why I opened a case with CP.

It has yet to be resolved and both support teams are looking into the issue. Will definitely keep you posted on the resolution.

Cheers

Re: Firemon and R81.10

the_rock — Wed, 06 Jul 2022 11:43:36 GMT

Just curious, have you done any captures on the firewall to see what happens with the traffic?

Re: Firemon and R81.10

Him — Mon, 22 Aug 2022 10:26:09 GMT

Good day Raj,

I am facing the same problem as you, may I know any update from checkpoint? Have you fix it?

Him

Re: Firemon and R81.10

Freco_Wong — Tue, 23 Aug 2022 03:46:19 GMT

I got the same problem too... anyone can help?

Re: Firemon and R81.10

Amir_Senn — Tue, 23 Aug 2022 07:42:37 GMT

Hi Raj,

Can you share TAC ticket information?

Re: Firemon and R81.10

M_Ruszkowski — Mon, 26 Sep 2022 15:31:54 GMT

CheckPoint is going to say it is not a CP issue and Firemon is going to say it is not a Firemon issue. We have been working through many issues with Firemon and CheckPoint ever sine we left R77.30 to go to R80.20 then to R80.40 and now to R81.10. It has been issues on both sides. We had a lot of issues with CP's API and how it was not returning everything to Firemon. And the MDS could not keep up with it. We had to adjust heap sixes on the MDS and we then had to work with Firemon because they were trying to grab everything at once. Not very efficient. Once Firemon fixed the way they were pulling data from the API things started working better. However we still had nothing but issues. Now on R81.10, the CP's API is better and the MDS is much faster. We just upgraded Firemon to 9.7.3 and we still don't have usage data working. Good luck.

Re: Firemon and R81.10

the_rock — Mon, 26 Sep 2022 15:38:07 GMT

I think you said it EXACTLY how it is!