topic External IOC feeds problem after update in Spark Firewall (SMB)

External IOC feeds problem after update

wladw — Tue, 10 Dec 2024 09:50:21 GMT

Good morning

After update to 81.10.15 we facing problem with external IOC feeds: data fetched successfully, but traffic to a hosts behind the gateway does not get blocked. Before the update everything was fine

Log with fetch info:

Time: 2024-12-10T09:04:21Z
Id Generated By Indexer:false
First: true
Sequencenum: 1
Severity: Informational
Description: External IOC - Fetch succeeded
Type: Control
Blade: Anti-Virus
Origin: GTW-N1
Product Family: Threat
Description: Anti-Virus

Debug:

$FWDIR/bin/ioc_feeder -d -f

cpIsDir: Calling cpIsDirEx: No such file or directory
Using two-stage load
IPS package: Compiled OK.
ERROR: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_IPS_GET was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
fwaccel_dos_ioctl_deny_list_ips_get returned false
ERROR: IOCTL command CPHWD_IOCTL_DOS_GET_NEXT_POLICY_ID was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
ERROR: Failed to get next policy id
ERROR: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_IPS_GET was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
fwaccel_dos_ioctl_deny_list_ips_get returned false
ERROR: IOCTL command CPHWD_IOCTL_DOS_GET_NEXT_POLICY_ID was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
ERROR: Failed to get next policy id
Signatures loaded successfully

Our feed format:

#! DESCRIPTION = TEST,,,,,,
#! REFERENCE = TEST,,,,,,
# Uniq-Name,#Value,#Type,#Confidence,#Severity,#Product,#Comment
8.8.8.8,8.8.8.8,IP,high,high,AB,2024-12-10 13:18:46 CheckPoint WebUI/SSH access from unallowed source

Also, after the update, such logs no longer appear:

Re: External IOC feeds problem after update

G_W_Albrecht — Tue, 10 Dec 2024 10:23:52 GMT

Better step back to R81.10.10 that is the recommended stable version !

Re: External IOC feeds problem after update

Chris_Atkinson — Tue, 10 Dec 2024 12:32:31 GMT

Please report the issue to TAC for further investigation

Re: External IOC feeds problem after update

wladw — Tue, 10 Dec 2024 12:58:42 GMT

The problem was solved after rollback

Re: External IOC feeds problem after update

the_rock — Tue, 10 Dec 2024 13:20:12 GMT

I agree with Chris. I would open TAC case and see if they possible have fix for it. Though @G_W_Albrecht is absolutely right, as per below sk, it does show recommended version at the moment.

https://support.checkpoint.com/results/sk/sk179615

Andy

Re: External IOC feeds problem after update

TJ_Aus — Mon, 03 Feb 2025 03:52:25 GMT

Confirmed the same on R81.10.15 996003913. Also worked after roll-back to R81.10.10 996002993

2025 Feb 3 11:28:34 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_IPS_GET was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:28:34 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_CLEAR was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:28:34 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_GET_NEXT_POLICY_ID was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:28:34 <hostname> user.info fwaccel: ERROR: fwaccel_dos_get_next_policy_id: Failed to get next policy id
2025 Feb 3 11:35:09 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_IPS_GET was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:35:09 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_CLEAR was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:35:10 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_GET_NEXT_POLICY_ID was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:35:10 <hostname> user.info fwaccel: ERROR: fwaccel_dos_get_next_policy_id: Failed to get next policy id
2025 Feb 3 11:36:01 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_IPS_GET was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:36:01 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_CLEAR was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:36:01 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_GET_NEXT_POLICY_ID was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:36:01 <hostname> user.info fwaccel: ERROR: fwaccel_dos_get_next_policy_id: Failed to get next policy id
2025 Feb 3 11:42:30 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_IPS_GET was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:42:30 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_CLEAR was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:42:30 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_GET_NEXT_POLICY_ID was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:42:30 <hostname> user.info fwaccel: ERROR: fwaccel_dos_get_next_policy_id: Failed to get next policy id
2025 Feb 3 11:43:21 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_IPS_GET was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:43:21 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_CLEAR was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:43:21 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_GET_NEXT_POLICY_ID was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:43:21 <hostname> user.info fwaccel: ERROR: fwaccel_dos_get_next_policy_id: Failed to get next policy id