Checkpoint VMSS deployment - Auto-provision test fails

[#1]

Hi Guys ,

I am deploying the Checkpoint VMSS solution in Azure .

For some reason the autoprovison test is failing with the below error -

.
Traceback (most recent call last):
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/monitor.py", line 4160, in <module>
rc = main(sys.argv)
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/monitor.py", line 4135, in main
test()
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/monitor.py", line 4047, in test
cls.test(cls, name=name, management=config['management']['name'], **c)
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/monitor.py", line 1995, in test
'GET', '/subscriptions/' + options['subscription'])
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/azure.py", line 411, in arm
with self.get_token() as token:
File "/etc/fw/Python/lib/python2.7/contextlib.py", line 17, in __enter__
return self.gen.next()
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/azure.py", line 355, in get_token
headers=headers, pool=self.pool, max_time=self.max_time)
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/azure.py", line 108, in request
max_time)
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/azure.py", line 190, in request_curl
raise CurlException(headers, args_no_auth)
CurlException: curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: http://curl.haxx.se/docs/sslcerts.html

Any idea what could be the issue ? I am using the latest autoprovision.cfg - version 509

[#2]

Hi Guys ,

I am deploying the Checkpoint VMSS solution in Azure .

For some reason the autoprovison test is failing with the below error -

.
Traceback (most recent call last):
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/monitor.py", line 4160, in <module>
rc = main(sys.argv)
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/monitor.py", line 4135, in main
test()
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/monitor.py", line 4047, in test
cls.test(cls, name=name, management=config['management']['name'], **c)
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/monitor.py", line 1995, in test
'GET', '/subscriptions/' + options['subscription'])
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/azure.py", line 411, in arm
with self.get_token() as token:
File "/etc/fw/Python/lib/python2.7/contextlib.py", line 17, in __enter__
return self.gen.next()
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/azure.py", line 355, in get_token
headers=headers, pool=self.pool, max_time=self.max_time)
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/azure.py", line 108, in request
max_time)
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/azure.py", line 190, in request_curl
raise CurlException(headers, args_no_auth)
CurlException: curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: http://curl.haxx.se/docs/sslcerts.html

Any idea what could be the issue ? I am using the latest autoprovision.cfg - version 509

[#3]

Hi Guys ,

I am deploying the Checkpoint VMSS solution in Azure .

For some reason the autoprovison test is failing with the below error -

.
Traceback (most recent call last):
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/monitor.py", line 4160, in <module>
rc = main(sys.argv)
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/monitor.py", line 4135, in main
test()
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/monitor.py", line 4047, in test
cls.test(cls, name=name, management=config['management']['name'], **c)
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/monitor.py", line 1995, in test
'GET', '/subscriptions/' + options['subscription'])
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/azure.py", line 411, in arm
with self.get_token() as token:
File "/etc/fw/Python/lib/python2.7/contextlib.py", line 17, in __enter__
return self.gen.next()
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/azure.py", line 355, in get_token
headers=headers, pool=self.pool, max_time=self.max_time)
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/azure.py", line 108, in request
max_time)
File "/opt/CPsuite-R80.20/fw1/scripts/autoprovision/azure.py", line 190, in request_curl
raise CurlException(headers, args_no_auth)
CurlException: curl: (60) SSL certificate problem: self signed certificate in certificate chain
More details here: http://curl.haxx.se/docs/sslcerts.html

Any idea what could be the issue ? I am using the latest autoprovision.cfg - version 509

[Abhishek_Singh1]

Yes, i am checked the syntax, everything looks perfect. 

Also, with autoprovision-cfg show all, I can see the proper settings. 

It's only when I run the service test command I get this error . 

I have not touched any settings anywhere else. 

Btw what version of autoprovisioning you ran, may be the latest ( version -509 ) is buggy... Thoughts? 

[Abhishek_Singh1]

Yes, i am checked the syntax, everything looks perfect. 

Also, with autoprovision-cfg show all, I can see the proper settings. 

It's only when I run the service test command I get this error . 

I have not touched any settings anywhere else. 

Btw what version of autoprovisioning you ran, may be the latest ( version -509 ) is buggy... Thoughts? 

[Abhishek_Singh1]

I have re-initialised the autoprovision service multiple times in different management servers as well but with no luck. 

@PhoneBoy - Is this a known bug for the autoprovision (ver-509) on R80.30 ?? 

I have raised a SR on this with TAC  , just wanted to know if you have any info or relevant folks that can look on this in priority. 

Issue recap - 

Checkpoint VMSS in Azure setup - Autoprovision issue

Installed the latest autoprovision (version - 509) and initialized the autoprovision service with the initial syntax successfully.

The autoprovision show all - display all the correct values for mn, tn, controllers, etc.

However, the "services autoprovision test " Commanda fails with some ssl error. Refer the attachment. 

[Abhishek_Singh1]

I have re-initialised the autoprovision service multiple times in different management servers as well but with no luck. 

@PhoneBoy - Is this a known bug for the autoprovision (ver-509) on R80.30 ?? 

I have raised a SR on this with TAC  , just wanted to know if you have any info or relevant folks that can look on this in priority. 

Issue recap - 

Checkpoint VMSS in Azure setup - Autoprovision issue

Installed the latest autoprovision (version - 509) and initialized the autoprovision service with the initial syntax successfully.

The autoprovision show all - display all the correct values for mn, tn, controllers, etc.

However, the "services autoprovision test " Commanda fails with some ssl error. Refer the attachment. 

[Abhishek_Singh1]

So it turns out the SMS is behind a Gateway firewall , which has HTTPS inspection enabled . Causing the SSL error on the test script.

After adding a temporary bypass rule , I am enable to get the test run successfully.

I wonder why the Checkpoint autoprovison script is not compatible with HTTPS inspection on Checkpoint . Sounds funny .

@PhoneBoy  - Worth raising this with the R&D .

[Abhishek_Singh1]

So it turns out the SMS is behind a Gateway firewall , which has HTTPS inspection enabled . Causing the SSL error on the test script.

After adding a temporary bypass rule , I am enable to get the test run successfully.

I wonder why the Checkpoint autoprovison script is not compatible with HTTPS inspection on Checkpoint . Sounds funny .

@PhoneBoy  - Worth raising this with the R&D .

[PhoneBoy]

The CA store used by the autoprovisioning process does not include the CA key used for HTTPS Inspection on managed gateways.
As a result, it's unable to validate the TLS certificate presented by the gateway when the connection is inspected, causing the connection to fail.
I suppose this could be automatically updated somehow, but that'd be an RFE.

[PhoneBoy]

The CA store used by the autoprovisioning process does not include the CA key used for HTTPS Inspection on managed gateways.
As a result, it's unable to validate the TLS certificate presented by the gateway when the connection is inspected, causing the connection to fail.
I suppose this could be automatically updated somehow, but that'd be an RFE.