Firemon and R81.10

[Raj_Khatri]

We are running Firemon which is tied into our MDS running R80.40.  After management was upgraded to R81.10, it has stopped working.  Firemon logs are showing error when communicating with a particular firewall.  The firewall listed should have no impact as it's retrieving data from the MDS/CMA.

Case already opened with both support teams and waiting to hear back.  Just wondering if anyone else has faced the same issues recently...  Thanks

[admin@server 10.x.x.x]$ fmos logview -Tf devpack.log
2022-06-24 12:41:41,950 1542853 [MainThread ] INFO fm.fwscripter: Logging in...
2022-06-24 12:41:41,950 1542853 [MainThread ] INFO fm.fwscripter: logging into domain: CMA
2022-06-24 12:41:41,950 1542853 [MainThread ] INFO fm.fwscripter: Executing login...
2022-06-24 12:41:41,950 1542853 [MainThread ] INFO fm.fwscripter: Attempt at login #1
2022-06-24 12:41:42,868 1542853 [MainThread ] INFO fm.fwscripter: Logged in.
2022-06-24 12:41:42,868 1542853 [MainThread ] INFO fm.fwscripter: Executing get publish data...
2022-06-24 12:41:42,868 1542853 [MainThread ] INFO fm.fwscripter: getting publish data
2022-06-24 12:41:42,868 1542853 [MainThread ] INFO fm.fwscripter: Executing show-last-published-session...
2022-06-24 12:41:42,962 1542853 [MainThread ] INFO fm.fwscripter: Executing get install data...
2022-06-24 12:41:42,963 1542853 [MainThread ] INFO fm.fwscripter: Executing show-gateways-and-servers...
2022-06-24 12:41:49,928 1542853 [MainThread ] INFO fm.fwscripter: Executing show-gateways-and-servers...
2022-06-24 12:41:51,686 1542853 [MainThread ] INFO fm.fwscripter: Domain is CMA
2022-06-24 12:41:51,687 1542853 [MainThread ] INFO fm.fwscripter: Executing run-script...
2022-06-24 12:41:53,253 1542853 [MainThread ] ERROR fm.fwscripter: error running command: run-script
2022-06-24 12:41:53,253 1542853 [MainThread ] ERROR fm.fwscripter: http status=404 content=b'{\n "code" : "generic_err_object_not_found",\n "message" : "Requested object [firewall] not found"\n}'
2022-06-24 12:41:53,253 1542853 [MainThread ] ERROR fm.fwscripter: An error occurred during retrieval: Please check logs for additional detail.
2022-06-24 12:41:53,253 1542853 [MainThread ] ERROR fm.fwscripter: http status=404 content=b'{\n "code" : "generic_err_object_not_found",\n "message" : "Requested object [firewall] not found"\n}'
2022-06-24 12:41:53,253 1542853 [MainThread ] ERROR fm.fwscripter: Traceback (most recent call last):
File "<string>", line 842, in retrieve_config
File "<string>", line 775, in gather_routes
File "<string>", line 61, in api_call
Exception: http status=404 content=b'{\n "code" : "generic_err_object_not_found",\n "message" : "Requested object [firewall] not found"\n}'

[PhoneBoy]

Given the tool generating these errors is from Firemon, not sure Check Point TAC can assist with this.

[the_rock]

I dealt with Firemon in my old job, but not for too long though. I will see if I can find some steps for you that could help. @PhoneBoy is right though...if those logs come from Firemon side, you may wish to check with them. I do find it a bit odd that issue happened after CP upgrade, so maybe worth checking CP logs as well.

[Raj_Khatri]

I was able to see the same errors in the api.elg logs.  Waiting on TAC to come back.

Thanks

[the_rock]

I actually emailed a contact from Firemon (had their email from 5 years ago) and guy said he was not aware of any issues with R81.10 that they could find in their database, so keep us posted on what TAC says.

[_Val_]

I do not think TAC should be the first point of contact here. Third-party product fails after CP upgrade, this should be taken with Firemon first. 

[the_rock]

Well, considering this worked before the upgrade, logically it would indicate problem on CP side, but lets see...just my 2 cents.Looking forward to resolution from @Raj_Khatri .

[_Val_]

@the_rock sorry, but I strongly disagree. I have seen tons of cases where upgrading CP led to failure on the third party due to implementation mishaps, API changes, and other things that were not addressed by the third party vendor. 

"If it worked before, it should work again" only applies to a single vendor implementation. If Firemon fails after CP upgrade, Firemon support should be the first point of contact. If they then said, take it with TAC, it is another matter.

[the_rock]

@_Val_ ...every case is different. Im just going based on logic here, since person at Firemon I contacted said they were not aware of any compatibility issues with R81.10 version.

Anyway, lets see how it gets solved.

[_Val_]

The person you contacted is not familiar with the actual issue, and his general information may be incomplete. 

[the_rock]

Considering he is a senior tech and I showed him this link, I tend to disagree with that statement : - )

[_Val_]

I do not see a point to continue this discussion. Unless we have an official conclusion this is not a Firemon issue, I will stick to my opinion. Hearsay does not cut it.

That said, everyone has a right to a different point of view 🙂

[the_rock]

I agree brother, I already moved on, no point spending time on trivial stuff : - )

Cheers.

[Raj_Khatri]

Initially a support case was opened with Firemon and they found a case with another customer that faced the same issue and was resolved by Checkpoint TAC, but never received the root cause to log in their system.  Hence why I opened a case with CP.

It has yet to be resolved and both support teams are looking into the issue.  Will definitely keep you posted on the resolution.

Cheers 

[the_rock]

Just curious, have you done any captures on the firewall to see what happens with the traffic?

[Amir_Senn]

Hi Raj,

Can you share TAC ticket information?

[Raj_Khatri]

SR#6-0003308885

[Him]

Good day Raj,

I am facing the same problem as you, may I know any update from checkpoint? Have you fix it?

Him

[Raj_Khatri]

No progress yet, TAC is trying to replicate in their lab.

[Freco_Wong]

I got the same problem too... anyone can help?

[M_Ruszkowski]

CheckPoint is going to say it is not a CP issue and Firemon is going to say it is not a Firemon issue.   We have been working through many issues with Firemon and CheckPoint ever sine we left R77.30 to go to R80.20 then to R80.40 and now to R81.10.   It has been issues on both sides.  We had a lot of issues with CP's API and how it was not returning everything to Firemon.  And the MDS could not keep up with it.  We had to adjust heap sixes on the MDS and we then had to work with Firemon because they were trying to grab everything at once.  Not very efficient.  Once Firemon fixed the way they were pulling data from the API things started working better.  However we still had nothing but issues.   Now on R81.10, the CP's API is better and the MDS is much faster.  We just upgraded Firemon to 9.7.3 and we still don't have usage data working.    Good luck.   

[the_rock]

I think you said it EXACTLY how it is!

[Freco_Wong]

Thanks for sharing, I was hit the exactly same situation (R77.30 > R80.10 > R80.40 > R81.10), recently I fixed the issue by adding new gateway to CheckPoint.

The API read back to normal and without below error message after added a new gateway to CheckPoint management, FYI.
"generic_err_object_not_found",\n "message" : "Requested object [firewall] not found"\n}'

And I found that CheckPoint was updated silently in JHF_T75 (which is Ongoing Take) about this...... refer to below IDs

PRJ-38800,
PRHF-23379

[Raj_Khatri]

Things are working with FMOS 9.5.6 but not 9.6.x or 9.7.x.

From Firemon - 

Starting in 9.6, we switched to retrieving routes via API for Check Point devices. The reason for switching is Check Point has been working to deprecate CPMI, so FireMon have to move towards using just the API for retrieval. This was part of a larger effort to convert the Check Point retrieval process to API only which eliminates the need for CPMI connectivity.  The retrieval error is happening because the API call is not responding in a way we would expect and it have to be solved from CP.

 I still get the same error message during retrievals.  Are you saying just by adding a new gateway to the CMA fixes the issue?

[Freco_Wong]

In my case, yes, and the error message is exactly same with yours.

FireMon is retrieving gateways by A-Z, in my case, I newly added a Checkpoint gateway as first one in A-Z list, for example: if your error appear from [firewall], just try to add new firewall named [Afirewall], not sure it will resolve your side too but my side's issue is gone... that retrieval & normalization back to normal

[Raj_Khatri · Accepted solution]

Received confirmation from R&D that "run-script" is not supported on SMB firewalls.  This method of retrieval was introduced in FMOS 9.6, hence the reason for failure.  Firemon developers will be returning to previous way of retrieving (hybrid).