cancel
Showing results for 
Search instead for 
Did you mean: 
Create a Post
Employee
Employee

Odd behaviour when using external IoCs - Feeds are successful, then partial, then fail completely...

Hi everyone,

Hi everyone,

I have a partner who is working with external IOC feeds on a 5x00 device.

He is using the test feeds in SK132193 and they exhibit the behaviour shown in the screenshots I have attached.  That is, at first they load successfully, then after about 30 minutes they report a partial failure, and then a complete failure to load.

He has verified there are no further external devices inhibiting communications, that he has installed the HFs according to the SK, and so on. 

Thank you for any help.  I have searched all of Support Centre, read all of the SKs I could find, and also run it past additional Check Point engineers to no avail.

Best regards,

-Brad

 

Screenshot 1.pngPartial failure.png

 

Full failure.png

0 Kudos
3 Replies
Admin
Admin

Re: Odd behaviour when using external IoCs - Feeds are successful, then partial, then fail completel

Perhaps as a separate thing I would manually fetch the feed using curl or similar periodically with a unique output file name.
This would allow you to see if there is a delta between the files you receive initially and subsequent ones.
If it's the same output that "worked initially" then started failing, that's obviously bad.
If there's something different in the file, then we need to see what's different and how that might be impacting import.
In any case, I highly recommend engaging the TAC with this.
0 Kudos
Employee
Employee

Re: Odd behaviour when using external IoCs - Feeds are successful, then partial, then fail completel

Thanks Phoneboy!  I have a TAC ticket opened.

I appreciate your help (as always)!

0 Kudos
Vladimir
Pearl

Re: Odd behaviour when using external IoCs - Feeds are successful, then partial, then fail completel

@Bradley_Fillo , please post your findings here, when you'll get to the bottom of this issue. I'd like to try using external IoCs myself and will be keeping an eye on this thread.

 

Thank you,

Vladimir

0 Kudos