topic Re: cpisp_update script does not work on R81.10? in General Topics

cpisp_update script does not work on R81.10?

Blason_R — Mon, 18 Dec 2023 07:33:36 GMT

Hello,

According to sk25152, it is necessary to make modifications to the cpisp_update script in order to manage static NAT when ISP Redundancy is enabled. However, during my troubleshooting process, I discovered that this script is not compatible with R81.10 and is not supported by the sk article either.

Due to the absence of the dynobj_cache table in R81.10, it is not possible to make the necessary decision. Therefore, I am curious about the alternative methods available for controlling Static NAT when ISP redundancy is enabled.

TIA

Blason R

Re: cpisp_update script does not work on R81.10?

PhoneBoy — Mon, 18 Dec 2023 13:55:08 GMT

As far as I know, this script is still valid.
In any case, it's probably worth engaging the TAC.

Re: cpisp_update script does not work on R81.10?

Blason_R — Mon, 18 Dec 2023 17:42:40 GMT

Nope it is not - That exact an issue I faced this morning and I tried flushing the dynobj_cache table and it says no such table exists. That means this script will not work

Re: cpisp_update script does not work on R81.10?

the_rock — Mon, 18 Dec 2023 17:56:24 GMT

I have custom script R&D gave me last year for R81.10, can send it to you if you prefer, not sure if it would work though.

Andy

Re: cpisp_update script does not work on R81.10?

Blason_R — Mon, 18 Dec 2023 17:58:38 GMT

Perhaps by examining the script, one may gain an understanding, as it is a straightforward bash script.

Re: cpisp_update script does not work on R81.10?

the_rock — Mon, 18 Dec 2023 18:02:27 GMT

Below is the link to it, not sure if you need to create an account to get it

Andy

https://andybee.sharefile.com/d-s9916ebbac8924613aba43487841be395

Re: cpisp_update script does not work on R81.10?

Blason_R — Mon, 18 Dec 2023 18:05:44 GMT

That is right - yeah.

It is not allowing me download and it needs a account.

Re: cpisp_update script does not work on R81.10?

the_rock — Mon, 18 Dec 2023 18:07:24 GMT

If you can send me your email in direct message, I can provide the link that way, and for that you 100% dont need an account.

Andy

Re: cpisp_update script does not work on R81.10?

Blason_R — Mon, 18 Dec 2023 18:10:43 GMT

Sent

Re: cpisp_update script does not work on R81.10?

the_rock — Mon, 18 Dec 2023 18:11:34 GMT

you should have it now, I sent it back

Andy

Re: cpisp_update script does not work on R81.10?

Blason_R — Mon, 18 Dec 2023 18:14:11 GMT

Got it - Thanks.

So just replace the entire script with this one?

Re: cpisp_update script does not work on R81.10?

the_rock — Mon, 18 Dec 2023 18:15:52 GMT

Yes sir. Make sure to backup the original file of course.

Andy

Re: cpisp_update script does not work on R81.10?

the_rock — Mon, 18 Dec 2023 19:54:37 GMT

Any luck?

Re: cpisp_update script does not work on R81.10?

Blason_R — Tue, 19 Dec 2023 07:37:42 GMT

Havent had a chance to replicate it. Let me do that in a day or two and revert

Re: cpisp_update script does not work on R81.10?

the_rock — Tue, 19 Dec 2023 13:07:43 GMT

K, no worries, take your time, hope it works.

Andy

Re: cpisp_update script does not work on R81.10?

dede79 — Thu, 22 Feb 2024 13:40:22 GMT

have same issue.....so the script was changed and no sk telling us that?

Customers having R81 still work....fresh setup under R81.20 no chance (HA....manual nat)

Re: cpisp_update script does not work on R81.10?

the_rock — Thu, 22 Feb 2024 13:56:33 GMT

Message me directly, I will send it to you. I have no clue if it was changed...I cant be 100% sure, but I would say 90% it was not modified. The only reason why we got it was due a client having really weird problem described in below post.

Best,

Andy

https://community.checkpoint.com/t5/Security-Gateways/Policy-push-overwrote-default-route-on-cluster-active-gateway/m-p/164496#M29447

Re: cpisp_update script does not work on R81.10?

the_rock — Thu, 22 Feb 2024 14:19:51 GMT

Responsed to your message mate. Ping me back if you need clarification.

Best,

Andy

Re: cpisp_update script does not work on R81.10?

dede79 — Tue, 05 Mar 2024 09:59:23 GMT

Update from TAC: sk25152 not supportet from R81.10 upwards. Supportet workaround would be using manual nat rules with zone in destination field.

Re: cpisp_update script does not work on R81.10?

pedkha — Mon, 18 Mar 2024 15:55:37 GMT

Hi, but how should we do it? do we still need to update the script? if we add zone to destination what will be the translated source field in the NAT rule, we have 2 addresses for ISP