topic Re: Pushing Security Policy using autoconf.clish error in Spark Firewall (SMB)

Pushing Security Policy using autoconf.clish error

Antonio_Martins — Wed, 27 May 2020 00:44:08 GMT

Hi CheckMates,

Everytime I use autoconf.clish to load the policy I receive this kind of errors:

_________________________________________________________________________________

Installing Security Policy...

sfw_make_policy_id: Warning: returning a dummy policy ID.

[ 17610 1999798272]@GW000[21 May 17:44:16]

sfw_load: Error loading security policy

Error loading policy.

sfw_fetch_callback: Failed to execute command '"/opt/fw1/bin/fw" fetchlocal -d "/opt/fw1/state/__tmp/FW1"'. rc=1, exit code =-1

Unable to install the Security Policy on the appliance

line 36: Autoconfiguration CLI script failed, clish return code = 1

_________________________________________________________________________________
Strangely the policy is fetched!

What can be wrong here?

Re: Pushing Security Policy using autoconf.clish error

PhoneBoy — Fri, 29 May 2020 19:26:30 GMT

If you execute the precise command you've specified above in expert mode, does it work?

Re: Pushing Security Policy using autoconf.clish error

Antonio_Martins — Sun, 31 May 2020 10:22:11 GMT

The policy is pushed when the autoconf.clish script runs. Nevertheless it creates a log file with this error message.

If I apply the configuration in clish I don't receive any error message.

Re: Pushing Security Policy using autoconf.clish error

G_W_Albrecht — Wed, 03 Jun 2020 07:35:41 GMT

I have often used autoconf.clish to configure IPs, Networks and WLAN, but these basic config never did push a security policy (as i did not define one in there). My questions:

- in which state of the box autoconf.clish is run (completely reset?)

- is it locally or centrally managed ?

Re: Pushing Security Policy using autoconf.clish error

Antonio_Martins — Wed, 03 Jun 2020 08:12:33 GMT

Yes, the gateway configuration was reverted to factory defaults before test.

The purpose is to automatically register it in Management Server (centrally managed).

I'm using this three commands at the end of the autoconf.clish:

set sic_init password <sic pass>
fetch certificate mgmt-ipv4-address <mgmt server ip> gateway-name <gateway name>
fetch policy mgmt-ipv4-address <mgmt server ip>

The script is working as the gateway is able to obtain the policy. I'm just curious about the error message.

Re: Pushing Security Policy using autoconf.clish error

G_W_Albrecht — Wed, 03 Jun 2020 08:42:33 GMT

You are using clish commands, but these are calling others like:

`fw fetch`	Fetch last policy
`fw fetchdefault [-h]`	Fetch default policy
`fw fetchlocal [-h]`	Fetch local policy

In Managed GWs, the GW will after reboot read both local policy and current policy from SMS; if they are the same, local copy will be installed, otherwise, fetched policy will be installed. Maybe when fetching policy from SMS, the unit found that the local policy is missing and issues an error - understandable after a reset to factory...