Issue running management via Harmony SASE

[StevePearson]

I have a customer that runs Harmony SASE for their remote access and has done for quite a while now with no issues.

We have recently upgraded the management server from R81.20 to R82.10 using the export/import method to allow us to increase disk sizes. When I exported it I got a warning about a changed config file $FWDIR/lib/implied_rules.def, and when I looked at this the change was to comment out one line as follows /* #define ENABLE_CPMI */

This stops implied rules accepting the control connections, so they have explicit rules in place to allow these connections, the reasoning being that trying to run SmartConsole remotely didn't work as the packets were not being encrypted, so this was the fix (sk105719). It's been working for several months with no issues.

After the upgrade I edited the file and made the same change, however it no longer appears to fix this issue, with the packets being accepted by the implied rules and not encrypted.

The sk mentions R82 but not explicitly R82.10 but I'm assuming that it's because it's yet to be updated.

Has anyone else come across this at all?

[Lesley]

Make sure to turn off policy installation acceleration since those files are not beeing transfered when this is active.

[StevePearson]

yes, policy acceleration was disabled when I pushed the policy

[Chris_Atkinson · Accepted solution]

I'm sure that you are all over this but make sure the file edited was also in the correct Management file path for your GW version e.g.

https://sc1.checkpoint.com/documents/R82.10/WebAdminGuides/EN/CP_R82.10_SecurityManagement_AdminGuid... 

[StevePearson]

Yes, and i've double checked this this morning.

[StevePearson]

Hi Chris,

Let me take back my earlier reply, I did indeed modify the wrong version of the file! Reading the guide you linked to in more detail made me realise the mistake!

Thanks for your help!

[StevePearson]

Just been testing this again and found that it works via a remote access VPN connection, but not via SASE connection. The difference here is that the RA VPN is a policy based VPN but SASE is a route based VPN.

It's worth saying that everything else is working correctly over SASE, so it's not an issue with the SASE tunnel itself.

The logs clearly show that as soon as I pushed the initial policy the CPMI packets are being accepted by the implied rules for some reason.