topic Re: Policy Installation Failure in General Topics

Policy Installation Failure

Matlu — Mon, 29 May 2023 21:28:17 GMT

Hello, everyone. 🙂

I have a ClusterXL, in R81.10 version.

I have created a host object, to add it to a group that I already had created, which in turn, belongs to a policy of blocking malicious IPs.

I have changed the "color" of the group object, to make it more "visible", but at the time of installing policies, I "splashed" the installation failure error.

No more changes appear neither pending, nor to discard.

I have closed the SmartConsole, and I have opened it again, and "apparently" my changes were executed.

Is this possible?

How can I be 100% sure, that my changes were applied, in spite of the error message in the installation of policies.

Thank you for your support.

Re: Policy Installation Failure

the_rock — Mon, 29 May 2023 23:22:29 GMT

You can go to smart console -> manage & settings -> reivions and see changes there. Im little confused though...were you able to apply policy again or still failing?

Andy

Re: Policy Installation Failure

Matlu — Tue, 30 May 2023 03:11:08 GMT

Hello, my friend.

The problem has been solved.

It turns out that the customer is "implementing" a new Firewall, in a new site, and is going to integrate it to the SMS, but by "ignorance", they seem to have created the Firewall object, and hooked it to the SMS, but the PROBLEM is that this Firewall "not even" has interfaces configured, and that began to generate problems with the installation of policies, which mentioned that the "New" Firewall did not have "not even" the Antispoofing configured.

We have deleted that Firewall Object from the SMS, and can now install policies again, quite an experience, hahahaha.

What remains as a question is, if even having failed the installation of policies, the changes can take effect?

Because when we had the error, we checked the SMARTCONSOLE and "apparently" the changes were executed well.

Greetings.

Re: Policy Installation Failure

just13pro — Tue, 30 May 2023 08:33:14 GMT

I think because of the publish, despite policy installation failed the publish normally will always successful.

Re: Policy Installation Failure

the_rock — Tue, 30 May 2023 11:06:15 GMT

It happens, all good : - )

Now you know for the next time, hehe.

Andy

Re: Policy Installation Failure

Matlu — Tue, 30 May 2023 11:49:00 GMT

Buddy 😄

If the "Install Policies" fails, but I see my changes in the SmartConsole, can I assume that everything "went well"?
If, for example, my change is to add an IP to block it, will the GW start blocking it, even though the policy installation failed?

Greetings.

Re: Policy Installation Failure

the_rock — Tue, 30 May 2023 11:52:43 GMT

No you can NOT assume that lol. What happens is this...say IF changes were published, but policy fails, changes wont apply and same old policy will still be enforced on the gateway, which easily can be verified by running either fw stat OR fw stat -b AMW

example in my lab:

quantum-firewall> exit
[Expert@quantum-firewall:0]# fw stat -b AMW
Anti Bot: Disabled (network signatures=0 behavioral=0)
Anti Virus: Disabled (network signatures=0 behavioral=0)
IPS: Enabled (use "ips stat")
Threat Emulation: Disabled
Threat Extraction: Disabled
Mail policy: Off
Zero Phishing: Off
files: http=0 ftp=0 smb=0 smtp=0 pop3=0
more: fileapp_ctx_enabled=0 ifi=1 http_dynamic_enabled=0 icap_server_enabled=0 min_severity=2 min_confidence=0
Policy: LAB-POLICY Mon May 29 09:39:08 2023 (traditional=1)
[Expert@quantum-firewall:0]#

Re: Policy Installation Failure

the_rock — Tue, 30 May 2023 11:55:03 GMT

Thats true, but someone not familiar with Check Point may simply assume that changes took effect, which is actually NOT the case,until successful policy install.

Andy

Re: Policy Installation Failure

Matlu — Tue, 30 May 2023 12:01:21 GMT

I understand.

One more doubt, I understand that there is an option in the SmartConsole, which is to "verify" the installation of policies, right?

I could use it, to validate, if there will be no problem, when I use the option to install policies, right?

🙂

Re: Policy Installation Failure

the_rock — Tue, 30 May 2023 12:05:01 GMT

Yup, I usually do that when I make lots of changes. Also, maybe enable below, so you can see changes there as well.

Andy

Re: Policy Installation Failure

Matlu — Tue, 30 May 2023 12:12:46 GMT

Do you recommend using the "Verify policy installation", before clicking on the "Install policy" button, as a security measure?

If I decide to apply this good practice, I should hit the "Verify" option after I "publish" the new changes I intend to send to my computers, right?

If the "verification" is successful, I can have the "peace of mind" to just send to Install policies, right?

Am I right in the flow?

🙂

Re: Policy Installation Failure

the_rock — Tue, 30 May 2023 12:15:38 GMT

You are right, BUT...there is always a but haha. So here is the thing...policy verification ONLY verifies changes made within the policy and NOT any changes made on the objects themselves, so as long as you only made policy changes, then I would say its not a bad idea to do so, as verifying will also do the publish as well.

Hope that helps.

Andy

Re: Policy Installation Failure

the_rock — Tue, 30 May 2023 12:25:41 GMT

Also, keep in mind, this has been available since R81

Accelerated policy install

Andy

Re: Policy Installation Failure

Matlu — Tue, 30 May 2023 12:25:58 GMT

Haaaa,

Imagine I have a policy in place to block malicious IPs.

And in this policy as DST, I have a group of IPs, named "Blacklist_IPs", and constantly, we add IPs to this group, to be blocked.

In this scenario, there is no need to do a "Policy Check" ????

😕

Re: Policy Installation Failure

the_rock — Tue, 30 May 2023 12:28:06 GMT

If I were you, I would not bother doing policy verify in that case. Chances it would fail are very small (I would say less than 1%), specially given the fact you simply keep adding bad IPs. We dod that for multiple customers and never had any issues.

Cheers,

Andy

Re: Policy Installation Failure

the_rock — Tue, 30 May 2023 12:37:52 GMT

Btw, there are other way to add bad IPs...one is also mgmt_cli and you can also create generic data center object and point to the file on mgmt server (can send you the file). I tested in the lab and it contains all know bad IP addresses you can use then those objects in the policy.

See example below in my lab.

Andy

mgmt_cli example:

mgmt_cli add host name "BAD_185.206.27.13" ip-address "185.206.27.13" --format json

Generic data center example:

Re: Policy Installation Failure

Matlu — Tue, 30 May 2023 12:56:07 GMT

It is becoming clearer to me.

So, this "Verify" option, it is better to use it when you make changes directly in the security policies (like deleting/adding, new objects in source, target, services, type of logs), right?

You told me, that this option also sends you to "Publish" the changes you intend to send, right?

So, if I change the SRC OBJECT of my policy, I click on "Verify", and this will do its job, plus the fact of "publishing" that change, right?

Thanks for your help, Buddy.

Re: Policy Installation Failure

the_rock — Tue, 30 May 2023 12:58:25 GMT

EXACTLY 🙂

Re: Policy Installation Failure

Matlu — Tue, 30 May 2023 17:35:05 GMT

Andy,

Where can I find the "Generic Data Center" object?

I am interested in deploying this solution in my environment.

What is the URL to put in this object?

Greetings.

Re: Policy Installation Failure

the_rock — Tue, 30 May 2023 17:40:34 GMT

Just for you bro, I put screenshots below...NO CHARGE ; - )

Andy