topic Checkpoint 1570 Appliance upgrade to 81.10 fail with No profile defined on GW in General Topics

Checkpoint 1570 Appliance upgrade to 81.10 fail with No profile defined on GW

George_Sas — Mon, 12 Jun 2023 11:32:30 GMT

Upgraded our management server to 81.10 , pushed policy to test if all ok and all was ok.

Then took a small office and upgraded the 1570 appliance to 81.10 and tried to push policy.

Standard policy was ok but Threat Prevention fails miserably .

Gateway: DCUK-xxxx
Policy: Standard
Status: Failed
- No profile defined on GW DCUK-xxxx
- gen_amw_rulebase_tables: gen_gw_profiles_set failed
- Operation was unsuccessful.
--------------------------------------------------------------------------------

I tested the solution suggested here on sk165935 but it does not work or I do not understand the article correctly ..

I am a bit uncertain of this statement "Assign the IPS profile on the relevant Security Gateway" ... I can only assign a profile on the GW general properties and in this case I can only assign "Custom" ... as Autonomous is not supported by 1500 series.

Am I missing something ?

Re: Checkpoint 1570 Appliance upgrade to 81.10 fail with No profile defined on GW

PhoneBoy — Mon, 12 Jun 2023 22:08:08 GMT

Yes, Autonomous Threat Prevention is not supported on SMB appliances.
"IPS Profile" only applies to pre-R80 gateways, for everything else not using ATP, it will depend on the Threat Prevention > Custom Settings rules.
What precise rules are there?
Screenshots (with sensitive details redacted) will help.

Re: Checkpoint 1570 Appliance upgrade to 81.10 fail with No profile defined on GW

Chris_Atkinson — Tue, 13 Jun 2023 04:00:49 GMT

Is this Gateway running R81.10.07 (996001397) or other version/build?

Re: Checkpoint 1570 Appliance upgrade to 81.10 fail with No profile defined on GW

George_Sas — Tue, 13 Jun 2023 06:33:37 GMT

Well, sk165935 does not say to much regarding the IPS profile and gateway type so I was kind confused.

I have also tried to remove the affected GW from the IPS / Threat Prevention rules and follow the SK165935 but this did not help either.

Re: Checkpoint 1570 Appliance upgrade to 81.10 fail with No profile defined on GW

George_Sas — Tue, 13 Jun 2023 06:34:09 GMT

Gateway runing Version: R81.10 (996000575)

Re: Checkpoint 1570 Appliance upgrade to 81.10 fail with No profile defined on GW

George_Sas — Tue, 13 Jun 2023 08:08:03 GMT

Well , mistery SOLVED.

After upgrading to 81.10 , the respective gateway was automatically REMOVED from my IPS / Threat prevention policy ????

I just upgraded another one and I noticed that the gateway was removed from the IPS policy after upgrade ?

Pushed policy ... fail.
Checked the IPS / Threat prevention policies and the gateway was NOT on any policy.

Added the gateway to the policy again , pushed policy and all went fine.

I have a policy for the small appliances and the next upgraded gateway vanished from the targets for that policy ... so no wonder the management server came and told me "No profile defined on GW" .. as there was no policy defined for that gateway so there was nothing to push..

I guess this can be defined as a Bug ? Why should a gateway remove itself from the policy after upgrade without any warnings ?

Re: Checkpoint 1570 Appliance upgrade to 81.10 fail with No profile defined on GW

_Val_ — Tue, 13 Jun 2023 08:11:39 GMT

yes sounds like a bug. Do you have a TAC case as a reference?

Re: Checkpoint 1570 Appliance upgrade to 81.10 fail with No profile defined on GW

George_Sas — Tue, 13 Jun 2023 08:13:19 GMT

No , no TAC case for this, we work with a checkpoint partner which did not open a TAC case I believe.

Re: Checkpoint 1570 Appliance upgrade to 81.10 fail with No profile defined on GW

_Val_ — Tue, 13 Jun 2023 08:14:35 GMT

Please ask them to report this to TAC, this is the only way to get it fixed.

Re: Checkpoint 1570 Appliance upgrade to 81.10 fail with No profile defined on GW

George_Sas — Tue, 13 Jun 2023 08:18:19 GMT

Will do , thanks.