topic Re: No SFTP any longer only Aspera in Service Requests in General Topics

No SFTP any longer only Aspera in Service Requests

Christian_Opitz — Tue, 18 Jun 2024 08:00:33 GMT

Hello,

as CP Partner we have to handle cases for many customers. Now I got the information in an Service Request that SFTP Accounts for uploading should be no longer used: "Unfortunately, SFTP account can only be provided if an issue occurs while uploading the files through the browser."

This means we have to transfer all requested files to us as first step and upload them afterwards to you via browser (altough it is faster via Aspera Plugin if you can use it but I don't like uploading gb via browser).

This is very impractical in particular at big files e.g. Crash Dumps and also at many files in folders. When using an account with limiting rights for scp transfer you will also have to copy it to another folder and change file rights or change a oot user to bash to have access to all folders each time.

Before we were able to use sftp command (if SFTP Acc was created), cpinfo -s (should also not used) or earlier cp_uploader directly on the gateway or at least at a customer system with internet access but so we always need additional a browser cause this is no longer possible from a check point system itself.

This is complex, bandwith intensive and needs more time for us.

Re: No SFTP any longer only Aspera in Service Requests

Arne_Boettger — Fri, 09 May 2025 07:19:19 GMT

Hello,

found your post while searching for the sk178326. We sometimes had success asking for an SFTP account instead, especially for uploading files directly from the affected devices. We, too, are very unhappy with the move to Aspera, especially because our Microsoft Defender for Endpoint complains about the version CheckPoint uses, because it is outdated.

Re: No SFTP any longer only Aspera in Service Requests

Jan_Kleinhans — Fri, 09 May 2025 07:52:44 GMT

We also don't like the Aspera. We cannot use the plugin because of internal policy. So uploads of GBytes takes very long and sometimes the uploads don't even work and you have to reupload or ask for an sftp account.

Maybe Checkpoint should evaluate the Tool and change to another one.

Re: No SFTP any longer only Aspera in Service Requests

Henrik_Noerr1 — Fri, 09 May 2025 08:03:17 GMT

We *never* use that plugin - and it would not be allowed by our organisation.

To rub it in - our jump hosts does not have internet access. So I would also need to offload the data to the jump host, then to my desktop (where I am not allowed to have this data) and then upload the data to Check Point. That would only slow me down and make me breach compliance guardrails.

We always use the cpinfo tool every time to upload data, and expect it to continue to work. This also means that support can never ever find the files, and we need to guide them.

Regards,

Henrik

Re: No SFTP any longer only Aspera in Service Requests

Jan_Kleinhans — Fri, 09 May 2025 08:59:47 GMT

We have exactly the same architecture. cpinfo upload is always "lost". But it would be the easiest way of uploading files.

Re: No SFTP any longer only Aspera in Service Requests

G_W_Albrecht — Fri, 09 May 2025 09:02:26 GMT

I always get SFTP credentials as upload in UserCenter is limited and Aspera not allowed - UC upload is possible but slower without Aspera. For server_migrate export you will not use Aspera but SFTP !

Re: No SFTP any longer only Aspera in Service Requests

Duane_Toler — Wed, 14 May 2025 13:57:19 GMT

Aye, I often had the same issue with uploads being "lost".

I got frustrated and opened a TAC case and got hold of someone who gave me some "inside scoop" on what happens when uploading giant files with "cpinfo -s <SR> -x -n -f ..". Apparently, the larger files do take a LOOOOOONG time to process on their end, and they are then copied over to a different server that the TAC folks can access. It also matters if your file is going to the server in Dallas or Ottawa, versus where the TAC engineer is. They may need to check the opposite server.

I don't wanna write out the names of these hosts here, but TAC folks on the inside should know which-is-which.

This is a process that could be improved, however. If for no reason other than to help the TAC folks need to do less "gymnastics" of their own. This would help us, the support partners, feel better about using the tools we're told to use (cpinfo -x -s -n -f) knowing that TAC is gonna get what we throw at them.

Re: No SFTP any longer only Aspera in Service Requests

Henrik_Noerr1 — Wed, 14 May 2025 18:30:21 GMT

ahh it makes perfect sense now! 🙂

Thanks