Re: IPS Management Update requires manual update

usukhbayar_g · ‎2025-10-26

Hello, community.

This issue has been here for almost 2 months. (I guess)

IPS update always requiring manual update from SmartConsole (Custom Policy->Updates-> Update Now

Also blade:IPS AND type:Control shows below.

Yes, I tried sk180762.
[[email protected]:0]# curl_cli -v -k http://dl3.checkpoint.com
* Rebuilt URL to: http://dl3.checkpoint.com/
* Trying 23.221.70.126...
* TCP_NODELAY set
* Connected to dl3.checkpoint.com (23.221.70.126) port 80 (#0)
< HTTP/1.1 302 Moved Temporarily
< Server: AkamaiGHost
< Content-Length: 0
< Location: http://downloads.checkpoint.com/dc/fileerror.htm
< Date: Mon, 27 Oct 2025 03:50:42 GMT
< Connection: keep-alive
<
* Connection #0 to host dl3.checkpoint.com left intact
[[email protected]:0]# curl_cli -v -k http://updates.checkpoint.com
* Rebuilt URL to: http://updates.checkpoint.com/
* Trying 18.64.8.40...
* TCP_NODELAY set
* Connected to updates.checkpoint.com (18.64.8.40) port 80 (#0)
< HTTP/1.1 404 Not Found
< Content-Type: text/plain; charset=utf-8
< Content-Length: 15
< Connection: keep-alive
< Date: Mon, 27 Oct 2025 03:50:53 GMT
< Server: awselb/2.0
< X-Cache: Error from cloudfront
< Via: 1.1 41a89bdb610eb303e698e5cb65ce5b76.cloudfront.net (CloudFront)
< X-Amz-Cf-Pop: ICN57-P2
< X-Amz-Cf-Id: 9FUSRIj4yugTyD4vDgHzT5VX1gMsFIXgGy1VAPiYeUtq7-SI7XPlDg==
<
* Connection #0 to host updates.checkpoint.com left intact
Page not found!

Since I know its not license. Did someone encoutered this issue, if yes, how did you resolved it?

SmartConsole version: 81.20.9700.671

the_rock · ‎2025-10-26

Silly question, but I suppose updates are set as scheduled in smart console? Can you ping updates.checkpoint.com?

Best,
Andy
"Have a great day and if its not, change it"

usukhbayar_g · ‎2025-10-26

Yes, I can.

PING d3dzd94mv2pmza.cloudfront.net (18.64.8.106) 56(84) bytes of data.
64 bytes from server-18-64-8-106.icn57.r.cloudfront.net (18.64.8.106): icmp_seq=1 ttl=242 time=205 ms
64 bytes from server-18-64-8-106.icn57.r.cloudfront.net (18.64.8.106): icmp_seq=2 ttl=242 time=204 ms
64 bytes from server-18-64-8-106.icn57.r.cloudfront.net (18.64.8.106): icmp_seq=3 ttl=242 time=204 ms
64 bytes from server-18-64-8-106.icn57.r.cloudfront.net (18.64.8.106): icmp_seq=4 ttl=242 time=204 ms
64 bytes from server-18-64-8-106.icn57.r.cloudfront.net (18.64.8.106): icmp_seq=5 ttl=242 time=204 ms
^C
--- d3dzd94mv2pmza.cloudfront.net ping statistics ---
5 packets transmitted, 5 received, 0% packet loss, time 4459ms
rtt min/avg/max/mdev = 204.404/204.566/205.133/0.638 ms

the_rock · ‎2025-10-26

K great. Well, since its midnight where I am, going to sleep, but will send you few things when I wake up from my lab, so you can verify in your environment.

Best,
Andy
"Have a great day and if its not, change it"

usukhbayar_g · ‎2025-10-26

Sure, good night then xD

the_rock · ‎2025-10-27

Hey @usukhbayar_g ,

Just to be 100% sure, can you compare what I attached here from the lab?

***********************

[Expert@CP-MANAGEMENT:0]# curl_cli -k updates.checkpoint.com
Page not found![Expert@CP-MANAGEMENT:0]# curl_cli -k cws.checkpoint.com
<HTML><HEAD><TITLE>Error</TITLE></HEAD><BODY>
An error occurred while processing your request.<p>
Reference #97.46182117.1761560792.4b7f98c7
<P>https://errors.edgesuite.net/97.46182117.1761560792.4b7f98c7</P>
</BODY></HTML>
[Expert@CP-MANAGEMENT:0]# ^C
[Expert@CP-MANAGEMENT:0]# curl_cli -k google.com
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="http://www.google.com/">here</A>.
</BODY></HTML>
[Expert@CP-MANAGEMENT:0]#

Best,
Andy
"Have a great day and if its not, change it"

usukhbayar_g · ‎2025-10-27

Only thing differs from your output is, when i curl_cli -k cws.checkpoint.com

[[email protected]:0]# curl_cli -k cws.checkpoint.com
<html><body><h1>It works!</h1></body></html>

the_rock · ‎2025-10-27

What about curl_cli -k google.com? FWIW, just to be sure, machine where smart console is instralled has full Internet connectivity? Also, what dns servers are configured on it?

Best,
Andy
"Have a great day and if its not, change it"

usukhbayar_g · ‎2025-10-27

[[email protected]:0]# curl_cli -k google.com
<HTML><HEAD><meta http-equiv="content-type" content="text/html;charset=utf-8">
<TITLE>301 Moved</TITLE></HEAD><BODY>
<H1>301 Moved</H1>
The document has moved
<A HREF="http://www.google.com/">here</A>.
</BODY></HTML>
[[email protected]:0]#

Machine running SmartConsole has full internet connectivity. And DNS is set to local DNS server.

the_rock · ‎2025-10-27

Can you try testing with google dns?

Best,
Andy
"Have a great day and if its not, change it"

the_rock · ‎2025-10-27

Do you get same output from both fw AND mgmt server?

Best,
Andy
"Have a great day and if its not, change it"

emmap · ‎2025-10-27

Is there a proxy server configured in Gaia or in SmartConsole for the SMS? When you manually update the IPS in SmartConsole it can use the internet connection from the PC you're running SmartConsole on (I think it gives you the option), and when you use 'curl_cli', unless you explicitly set a proxy in your command, it won't use one, regardless of proxy config.

the_rock · ‎2025-10-27

EXCELLENT point Emma. Did not think of that, but makes total sense.

Best,
Andy
"Have a great day and if its not, change it"

usukhbayar_g · ‎2025-10-27

Hi @emmap,
There is no proxy configured in this environment. So I guess I don't have to set a proxy option in my command.

the_rock · ‎2025-10-27

Just curious, did this ever work?

Best,
Andy
"Have a great day and if its not, change it"

usukhbayar_g · ‎2025-10-31

If you are talking about automatic update, yes. Also we don't have proxy before and after this issue shows up.

Machine_Head · ‎2025-10-31

To update IPS database on a gateway you roughly have two options, as defined in the gateway object IPS tab:

First one is directly from gateway.
Second one from Manager
- via Manual or scheduled DB download
  - then pushing TP policy manual or scheduled too

In the Title you mention "management" udpate but in the screenshots you show a gateway failing to download the package.

So what are you really trying to troubleshoot? The gateway or the manager?

To find more detail about why the gateway is failing to download the package you can debug FWD

Make sure to check this sk also
https://support.checkpoint.com/results/sk/sk179425

the_rock · ‎2025-10-31

I believe they have all that set up already, but good sk to follow, for sure.

Best,
Andy
"Have a great day and if its not, change it"

Are you a member of CheckMates?

IPS Management Update requires manual update