topic Re: Error: Update failed. Contract entitlement check failed. Gateway can not access internet in General Topics

Error: Update failed. Contract entitlement check failed. Gateway can not access internet

Jerry — Thu, 04 Jun 2020 10:29:30 GMT

Error: Update failed. Contract entitlement check failed. Gateway can not access internet ("https://updates.checkpoint.com/WebService/services/DownloadMetaDataService"). Check connectivity and proxy settings.

6 SG's and 3 SMS's has at this very time same error - anyone else has it just now or something has happened on the CP Clould side?

would appreciate heads up.

Anti-Bot Update Status

Name	Value
Status	Failed
Description	Update failed. Contract entitlement check failed. Gateway can not access internet ("https://updates.checkpoint.com/WebService/services/DownloadMetaDataService"). Check connectivity and proxy settings.
Next update	The next try will be within one hour.
Version	2006022334

cheers

Re: Error: Update failed. Contract entitlement check failed. Gateway can not access internet

Ilya_Avetisyan — Thu, 04 Jun 2020 10:33:20 GMT

Hi
I see the same with our 4 appliances

Re: Error: Update failed. Contract entitlement check failed. Gateway can not access internet

Jerry — Thu, 04 Jun 2020 10:34:28 GMT

meaning we've got an issues with AntiBot Contract(s) entitlement on the CP side - anyone else ?

Re: Error: Update failed. Contract entitlement check failed. Gateway can not access internet

moritz_r — Thu, 04 Jun 2020 10:36:48 GMT

Hello @Jerry , it seems there is a issue with the update services from checkpoint. multiple customers complains about this issue and we are facing it as well.
After askning TAC I receved an feedback: "currently having an issue with our cloud and this is the reason for the issue"

I hope it will be solved soon.

Best regards

Re: Error: Update failed. Contract entitlement check failed. Gateway can not access internet

Jerry — Thu, 04 Jun 2020 10:38:50 GMT

awesome, would be great if such circumstances could be announced on CheckMates as well in a form of TABLE of the "SERVICE STATUS" or something - don't you think chaps?
@PhoneBoy
@Heiko
@TimHall
@Danny

cheers

Re: Error: Update failed. Contract entitlement check failed. Gateway can not access internet

Wolfgang — Thu, 04 Jun 2020 10:49:03 GMT

https://status.checkpoint.com/

Wolfgang

Re: Error: Update failed. Contract entitlement check failed. Gateway can not access internet

Jerry — Thu, 04 Jun 2020 10:50:10 GMT

oh sugar, sorry forgot about that one, cheers Wolfgang! spot on 🙂

Re: Error: Update failed. Contract entitlement check failed. Gateway can not access internet

HristoGrigorov — Thu, 04 Jun 2020 10:51:38 GMT

Posted workaround for the problem earlier today if you are interested:

https://community.checkpoint.com/t5/General-Topics/Failure-to-fetch-updates-from-CheckPoint-servers/m-p/87250

Re: Error: Update failed. Contract entitlement check failed. Gateway can not access internet

Jerry — Thu, 04 Jun 2020 10:53:44 GMT

awesome! works like a charm, cheers!

Re: Error: Update failed. Contract entitlement check failed. Gateway can not access internet

Wolfgang — Thu, 04 Jun 2020 10:54:43 GMT

@_Val_ remind us this morning ...

https://community.checkpoint.com/t5/General-Topics/All-updates-and-Upgrade-Checks-are-failing/m-p/87253#M17518

Wolfgang

Re: Error: Update failed. Contract entitlement check failed. Gateway can not access internet

Jerry — Thu, 04 Jun 2020 10:56:21 GMT

my apology, overlooked that post sorry 😞 but now all is crystal clear.

cheers to all ! EOT and awaiting a "fix" 😛

Re: Error: Update failed. Contract entitlement check failed. Gateway can not access internet

HristoGrigorov — Thu, 04 Jun 2020 10:58:05 GMT

No worries. Happy it works for you as well 😀

Re: Error: Update failed. Contract entitlement check failed. Gateway can not access internet

anstelios — Thu, 04 Jun 2020 12:06:53 GMT

Any chance this is resolving the cloud emulation problem also ??

Probably not but has anyone tried it??

Re: Error: Update failed. Contract entitlement check failed. Gateway can not access internet

_Val_ — Fri, 05 Jun 2020 05:21:36 GMT

All back to normal

Re: Error: Update failed. Contract entitlement check failed. Gateway can not access internet

_Val_ — Fri, 05 Jun 2020 05:22:23 GMT

Services are restored. It was an third party issue, just FYI

Re: Error: Update failed. Contract entitlement check failed. Gateway can not access internet

HristoGrigorov — Fri, 05 Jun 2020 05:24:45 GMT

Third-party is involved in delivering updates? Should I be worried ? 🤔

Re: Error: Update failed. Contract entitlement check failed. Gateway can not access internet

Jerry — Fri, 05 Jun 2020 07:01:18 GMT

time for

#cpprod_util CPPROD_SetValue "CPshared//6.0//reserved//libCurl" crl_disable 1 01

am I right Hristo? 🙂

reg. 3rd Party - that's how you call it but in fact it is usually someone called "Supplier" and that isn't anything to worry about 🙂

Re: Error: Update failed. Contract entitlement check failed. Gateway can not access internet

HristoGrigorov — Fri, 05 Jun 2020 07:07:59 GMT

Yes, that command will re-enable CRL checks in curl_cli. But it is 1 0 1 and not 1 01, sorry I fixed it in my post.

You may run curl_cli -v ... after that to test it.

I am personally going to leave it disabled. Don't care too much if CheckPoint certificates are revoked as long as updates are working 🙂

I was joking about the third-party... Think, even your ISP is such one. 😀

Re: Error: Update failed. Contract entitlement check failed. Gateway can not access internet

Jerry — Fri, 05 Jun 2020 07:12:40 GMT

[Expert@cp:0]# curl_cli -v -k https://updates.checkpoint.com/WebService/services/DownloadMetaDataService
* Trying 23.217.5.127...
* Connected to updates.checkpoint.com (23.217.5.127) port 443 (#0)
* ALPN, offering http/1.1
* Cipher selection: HIGH:!RC4:!LOW:!EXP:!aNULL:!SSLv2:!MD5:!aECDH:!EDH
* *** Current date is: Fri Jun 5 08:12:04 2020
* TLSv1.2 (OUT), TLS header, Certificate Status (22):
* TLSv1.2 (OUT), TLS handshake, Client hello (1):
* err is -1, detail is 2
* *** Current date is: Fri Jun 5 08:12:04 2020
* TLSv1.2 (IN), TLS handshake, Server hello (2):
* err is -1, detail is 2
* *** Current date is: Fri Jun 5 08:12:04 2020
* TLSv1.2 (IN), TLS handshake, Certificate (11):
* TLSv1.2 (IN), TLS handshake, Server key exchange (12):
* TLSv1.2 (IN), TLS handshake, Server finished (14):
* TLSv1.2 (OUT), TLS handshake, Client key exchange (16):
* TLSv1.2 (OUT), TLS change cipher, Client hello (1):
* TLSv1.2 (OUT), TLS handshake, Finished (20):
* err is -1, detail is 2
* *** Current date is: Fri Jun 5 08:12:04 2020
* TLSv1.2 (IN), TLS change cipher, Client hello (1):
* TLSv1.2 (IN), TLS handshake, Finished (20):
* SSL connection using TLSv1.2 / ECDHE-RSA-AES256-GCM-SHA384
* ALPN, server accepted to use http/1.1
* servercert: Activated
* servercert: crl_disable from registry: 1
* servercert: CRL validation was disabled
* Server certificate:
* subject: CN=*.checkpoint.com
* start date: Jun 4 13:23:27 2020 GMT
* expire date: Sep 7 13:23:27 2022 GMT
* issuer: C=BE; O=GlobalSign nv-sa; CN=GlobalSign RSA DV SSL CA 2018
* SSL certificate verify result: unable to get local issuer certificate (20), continuing anyway.
* servercert: Finished
< HTTP/1.1 200 OK
< Content-Type: text/xml;charset=UTF-8
< Content-Length: 410
< Server: Apache-Coyote/1.1
< Date: Fri, 05 Jun 2020 07:12:05 GMT
< Connection: keep-alive
<
* Connection #0 to host updates.checkpoint.com left intact
<soap:Envelope xmlns:soap="http://schemas.xmlsoap.org/soap/envelope/"><soap:Body><checkpoint:BusinessFault xmlns:checkpoint="urn:downloadcenter"><checkpoint:BusinessFault><checkpoint:code>002</checkpoint:code><checkpoint:message>Request Invalid</checkpoint:message><checkpoint:details>XML Translation Failed</checkpoint:details></checkpoint:BusinessFault></checkpoint:BusinessFault></soap:Body></soap:Envelope>

Re: Error: Update failed. Contract entitlement check failed. Gateway can not access internet

_Val_ — Fri, 05 Jun 2020 07:22:48 GMT

There was as CRL issue with signing CA. Which is public, third party. Jerry kinda hinted to in the comments below