topic Re: R80.40 - Issues in General Topics

R80.40 - Issues

Rui_Gomes_PT — Fri, 28 Feb 2020 10:45:41 GMT

Hi,

Deployed R80.40 on 2 clusters and these are the issues I'm facing:

Some times when installing a policy I get the error "Installation failed. Reason: Load on Module failed - problem with the Commit Function." on one of the nodes. On second (or third) try the policy is installed;
Currently we have one management machine that is also the Smart Event server and correlation unit. On this version if I enable the SmartEvent I get multiple issues.. Several processes (SmartLog_Server, SmartView,etc) do several restarts. The logs are not displayed in real time. etc
Custom Intelligence Feeds (based on sk132193) the feeds are configured correctly, but after some time I get "Feed log External IOC - Failed to load indicators". On some nodes this problem is fixed with no intervention, but after some time it returns;
On rare occasions after a reboot one of the nodes loads the initial policy (this started occurring only after upgrade to R80.40

Hope this helps with the first R80.40 hotfix

Re: R80.40 - Issues

Danny — Fri, 28 Feb 2020 12:32:42 GMT

Which Check Point Appliances are you using?

Re: R80.40 - Issues

Rui_Gomes_PT — Fri, 28 Feb 2020 12:34:41 GMT

@Danny 15400, with management on vmware

Re: R80.40 - Issues

Benedikt_Weissl — Fri, 28 Feb 2020 15:43:16 GMT

Is IPS enabled? Any drops between SMS and Cluster Nodes in the log? How high is the load on your active Gateways?

Re: R80.40 - Issues

Rui_Gomes_PT — Fri, 28 Feb 2020 15:46:09 GMT

IPS is enabled.. Regarding the load.. The same load we had on R80.30 and previous..

Re: R80.40 - Issues

PhoneBoy — Fri, 28 Feb 2020 16:06:41 GMT

You have any TAC cases on these issues?

Re: R80.40 - Issues

Rui_Gomes_PT — Fri, 28 Feb 2020 16:13:42 GMT

@PhoneBoy not yet. Will open one next week.. Just posted this issues here to see if there was anyone with the same issues...

Re: R80.40 - Issues

Daniel_Kavan — Wed, 10 Jun 2020 19:08:03 GMT

What does everyone think about this idea?

Run one clusterXL gateway node with R80.40 (3.10) XFS (re-formatted, re-built), but the other R80.40 (3.10) node will still be running with ext3 exclusively. Would that be supported?

Re: R80.40 - Issues

PhoneBoy — Thu, 11 Jun 2020 03:04:52 GMT

Assuming otherwise same hardware, I don't believe it will be an issue.

Re: R80.40 - Issues

Ilya_Yusupov — Thu, 11 Jun 2020 07:06:46 GMT

hi @Rui_Gomes_PT ,

It might be crazy or funny but i encounter such case where i had duplicate IP and on the Duplicated IP i had initial policy.

so each reboot i saw initial_policy instead of real policy.

Any chance that you have Duplicate IP?

If not do you see any failure messages in dmesg post boot?

Re: R80.40 - Issues

Daniel_Kavan — Fri, 12 Jun 2020 18:28:17 GMT

It would be nice if when you did a fresh install of R80.40 for example in CPUSE it would ask for your formatting size, and IP addresses so you could do a fresh install from CPUSE, rather than mounting an ISO.

Re: R80.40 - Issues

Boaz_Orshav — Sun, 14 Jun 2020 04:14:11 GMT

Hi
CPUSE is for version clean installation while iso is for machine clean installation.
There are many differences such as CPUSE does not re-install the log partition, logs from previous installations are kept etc.
Most important - CPUSE creates a snapshot during installation which makes the revert easy and if the installation fails it automatically reverts.
Such features are not supported on iso installation where you can change partition size, file system (xfs/ext3) and others.

Re: R80.40 - Issues

PhoneBoy — Sun, 14 Jun 2020 07:55:13 GMT

Installing from ISO completely reformats the hard drive, which is necessary in certain circumstances (e.g. changing from ext3 to xfs, which also changes the partitioning scheme).
This is not possible when upgrading from CPUSE.

Re: R80.40 - Issues

Daniel_Kavan — Fri, 24 Jul 2020 14:50:53 GMT

Hi!

Has anyone run into issues with trouble getting to hosted http2 websites behind R80.40. I have a TAC issue for this as well. Traffic comes into DMZ#1 to hit an Apache reverse proxy then is terminated and sent to DMZ#2 webservers. HTTPS inspection is turned off on this gateway.

This shows in not working with http2
curl --http2 -k https://new-sterling.mydomain.com <html><body><h1>400 Bad request</h1>
Your browser sent an invalid request.

This shows it working with http 1.1
curl --http1.1 -k https://new-sterling-mydomain.com
<html>
<body bgcolor=white>
<center>Hello World!</center>

UPDATE: This working now, it was NOT an issue with HTTP/2 or R80.40.

Re: R80.40 - Issues

PhoneBoy — Wed, 22 Jul 2020 15:52:28 GMT

My understanding is that HTTPS Inspection is required for HTTP/2 support.

Re: R80.40 - Issues

Ilya_Yusupov — Wed, 22 Jul 2020 15:52:34 GMT

hi @Daniel_Kavan ,

i will take it offline with you.

Thanks,

Ilya

Re: R80.40 - Issues

Daniel_Kavan — Mon, 24 Aug 2020 17:33:20 GMT

Subject: R80.40 or R81

Does anyone know if Check Point is working on or has the capability to upgrade to a new major version of Check Point with out getting a new AMI from AWS. For example if I have a firewall with a R80.30 AMI up and running can I update to R80.40 with out needing to get a new AMI? Or is that capability not until R81? Could I upgrade from R80.30 to R81 with the current AMI or do I still need a new AMI?

Re: R80.40 - Issues

PhoneBoy — Mon, 24 Aug 2020 22:16:42 GMT

As far as I know, this isn't possible currently.
Will it be in the future? Don't know.
I do know prior to R80.40, the AMI versions weren't exactly maintrain as they were on the 3.10 kernel, which was not maintrain on gateways.
There are a few other differences as well.
That suggests it may be possible in the future, but there may be some technical reason why we can't do it.

Re: R80.40 - Issues

Daniel_Kavan — Tue, 25 Aug 2020 14:09:54 GMT

I can send Gaia OS syslogs (/var/log/messages) to smartlog, but I can't search and sort on the message itself. IOW, the messages aren't indexed. Blade:Syslog shows the logs in R80.30. I can then see the messages if I open up each log. However, I can't search or sort the messages. It would be nice to combine all the like messages or even create a report on them. Is there any additional capability for syslog in R80.40 or in the plans for R81?

Re: R80.40 - Issues

PhoneBoy — Tue, 25 Aug 2020 17:25:30 GMT

The specific field used for syslog messages is not indexed.
That means you can't search or run reports on it.
That hasn't changed in R80.40 and don't believe that's changed in R81 either.

Understanding your precise use cases may be useful here, as we'd also probably have to parse the syslog messages more than we do currently (something that's not currently done, either).