Deployment rules bypassed

[RS_Daniel]

Hi CheckMates,

We have a customer with R81 endpoint management on the cloud with around 1300 endpoints already deployed. Have a deployment policy with many rules applied for specific virtual groups with specific versions installed, and a default deployment rule that was on version E84.50 with many blades, there were no machines matching this rule, because all of them were included on virtual groups of higher rules.

We started to use Push Operation "Deploy New Agents" to install Harmony Endpoint remotely, and noticed that these endpoints match on default deployment rule, so, we changed the version of default deployment rule to E86 to avoid installing an old version. After this change all our deployment rules are being bypassed, our entire deployment is matching default deployment rule now. It brought some problems with the deployment as this upgrade was not considered. However we now want to focus on how to fix this. 

We tried creating new deployment rules with new virtual groups with higher versions, but endpoints just do not match. Our main goal is to uninstall some blades like firewall, but do not find a way to get this.

Does somebody know how to make deployment rules to work again?

TAC advised to change default rule to "Do Not Install" but, will this have any impact on the 1300 endpoints that are matching this rule rigth now? We need to avoid a new massive upgrade on the endpoints. Is this a normal behavior? according to admin guide "The Default Policy rule applies to all Endpoint devices for which no other rule in the Rule Base applies." and do not mention nothing about having default rule with Do Not Install.

Any help is appreciated!!!

Regards

[jcortez]

@RS 

It actually sounds like a database corruption in regards to either the deployed policies (software deployment policies) or the saved/changed policies (also software deployment policies). This would require you to open a SR with TAC (endpoint team in TAC) to work on this with you and possible make some database changes.

Could be this SK that is the issue...

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[RS_Daniel]

Hello @jcortez ,

Thanks for your reply. Yes, it was indeed a database corruption on the server. Accorging to TAC, some rules were not correctly loaded to the database, they existed as objects but did not have a correlating object within the deployed policy. Unfortunately, it was not possible to find root cause and from CheckPoint can not guarantee this will not heppen again in the future 😑.

Well, the the database is already fixed and we are going to solve the problems it caused.

Regards

[jcortez]

Oh okay good. Yeah there are no guarantees with database issues like this that the issue will not come back since it may be due to previous corruption that just showed itself that could still be lingering or due to a bug that has not been dealt with yet.

But I am glad they identified the issue and were able to get you up and running.