topic Re: SecureXL - Alternative method to identify rule causing templates to be disabled in General Topics

SecureXL - Alternative method to identify rule causing templates to be disabled

Michael_Horne — Thu, 13 Feb 2020 11:10:09 GMT

Hello,

Is there are alternative way to identify exactly what is causing Accept Templates to be disabled. The output from the "fwaccel stat" has a output display issue and does not show me the information.

fwaccel stat

All I can see is "Layer ---", there is a missing carriage return and then "Drop Templates".

Many thanks,

Michael

Re: SecureXL - Alternative method to identify rule causing templates to be disabled

G_W_Albrecht — Thu, 13 Feb 2020 12:24:36 GMT

Which version do you use ? Afaik, this is the only way to display these layers. Even looks like an issue for TAC to me...

Re: SecureXL - Alternative method to identify rule causing templates to be disabled

Michael_Horne — Thu, 13 Feb 2020 12:36:00 GMT

ZZZZZZZZ> cpinfo -y all

This is Check Point CPinfo Build 914000202 for GAIA
[IDA]
No hotfixes..

[MGMT]
HOTFIX_R80_30_JUMBO_HF_MAIN Take: 111

[CPFC]
HOTFIX_R80_30_JUMBO_HF_MAIN Take: 111

[FW1]
HOTFIX_R80_30_JUMBO_HF_MAIN Take: 111

FW1 build number:
This is Check Point's software version R80.30 - Build 078
kernel: R80.30 - Build 076

[SecurePlatform]
HOTFIX_R80_30_JUMBO_HF_MAIN Take: 111

[DIAG]
No hotfixes..

[PPACK]
HOTFIX_R80_30_JUMBO_HF_MAIN Take: 111

[CVPN]
No hotfixes..

[CPUpdates]
BUNDLE_CPINFO Take: 50
BUNDLE_INFRA_AUTOUPDATE Take: 19
BUNDLE_DEP_INSTALLER_AUTOUPDATE Take: 13
BUNDLE_R80_30_JUMBO_HF_MAIN_SC Take: 132
BUNDLE_R80_30_JUMBO_HF_MAIN Take: 111

[CPinfo]
No hotfixes..

[AutoUpdater]
No hotfixes..

[CPDepInst]
No hotfixes..

Re: SecureXL - Alternative method to identify rule causing templates to be disabled

Timothy_Hall — Thu, 13 Feb 2020 13:10:16 GMT

Is the firewall being managed by MDSM/Provider-1, and if so are there global rules being inserted at the top of the policy? Also please provide the output of enabled_blades.

Re: SecureXL - Alternative method to identify rule causing templates to be disabled

Michael_Horne — Thu, 13 Feb 2020 13:21:42 GMT

Hello,

The cluster is not managed as part of a MDM environment, so there are not global rules. the following blades are activated:

Blades

Regards,

Michael

Re: SecureXL - Alternative method to identify rule causing templates to be disabled

Timothy_Hall — Thu, 13 Feb 2020 14:02:48 GMT

Try temporarily disabling Anti-bot, reinstall policy, then check Accept templating status again.

Re: SecureXL - Alternative method to identify rule causing templates to be disabled

Michael_Horne — Thu, 13 Feb 2020 14:55:40 GMT

Hello Unfortunately no difference after disabling Anti-Bot blade.

Re: SecureXL - Alternative method to identify rule causing templates to be disabled

_Val_ — Thu, 13 Feb 2020 15:38:10 GMT

Are you using any of those in the policy: dhcp-request' / 'dhcp-reply' / 'dhcpv6-request' / 'dhcpv6-reply' / 'dhcpv6-relay?

If yes, look here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk162544

Re: SecureXL - Alternative method to identify rule causing templates to be disabled

Timothy_Hall — Thu, 13 Feb 2020 22:50:05 GMT

Strange, it looks like fwaccel stat is not displaying its output correctly. Please provide the output of fwaccel templates -s and fwaccel templates -S, as I suspect Accept templating is actually working.

Re: SecureXL - Alternative method to identify rule causing templates to be disabled

Timothy_Hall — Thu, 13 Feb 2020 22:52:33 GMT

Ah here we go, your policy layer name must be longer than 32 characters. Shorten it and the fwaccel stat output will start working correctly:

sk145533: "Layer ---" is displayed instead of specific layer name and rule number in output of 'fwaccel stat'

Re: SecureXL - Alternative method to identify rule causing templates to be disabled

Michael_Horne — Fri, 14 Feb 2020 09:24:54 GMT

Thanks, this solved the display issue.