R80.10 Errors

[Mick_OToole]

Hi all, I recently uploaded my configuration to the R80.10 Upgrade Verification Service. It came back with 2 errors. One was very easy to fix up (an unsupported UTM-1 appliance) the other one is a little harder to figure out. It says: Corrupted objects ids  Description: Database contains corrupted object ids and therefore objects' functionality will be damaged Please consult support how to fix the following corruption(s): Table: asm Object name: A9F495C17-992D-4451-B3E0-FC35BE3F6D45 Object id: {9F495C17-992D-4451-B3E0-FC35BE3F6D4 ‚

Any ideas?

[Johnathan_McGu1]

Hi Mick,

From sk117237 - R80.10 Pre-Upgrade Verifier notifications and their solutions:

Corrupted object IDs

There are objects with corrupted UID. For example: UID string length is not 38 UID string does not start with "{", does not end with "}" hyphens are not in the right places hex digits are not in the right places

Contact Check Point Support for assistance, or follow the below procedure: Background The Object's UID should look like this: {XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX} The length of the entire string is 38 characters: 2 brackets - at positions 1 and 38 4 hyphens - at positions 10, 15, 20 and 25 8 hex digits - at positions 2 - 9 4 hex digits - at positions 11 - 14 4 hex digits - at at positions 16 - 19 4 hex digits - at positions 21 - 24 8 hex digits - at positions 26 - 37 allowed hex digits - 0,1,2,3,4,5,6,7,8,9,a,b,c,d,e,f Procedure Collect the complete backup (refer to sk108902). Generate a new UID using the following online generator: http://www.guidgen.com Edit the $FWDIR/conf/objects_5_0.C file using and advanced text editor (Vi, Notepad++, etc.) Change the corrupted UID to the generated UID

hope this helps.

[Mick_OToole]

Hi Jonathan,

I had seen that before (sorry, should have mentioned this in original post) but in the objects_5_0.C file there is no UID matching the one that the installed flagged. 

I did however find the UID in the $FWDIR/conf/asm.C file and I believe that this is the cause of my error.

In the asm.C file I can see the following ...

...

: (A9F495C17-992D-4451-B3E0-FC35BE3F6D45
:AdminInfo (
:ClassName (simple_pattern_definition)
:chkpf_uid ("{9F495C17-992D-4451-B3E0-FC35BE3F6D4 ‚")
:table (asm)

...

I'm pretty sure that should read 

:chkpf_uid ("{9F495C17-992D-4451-B3E0-FC35BE3F6D45}") 

as per the error that I received from the R80.10 Upgrade Verification Service.

Corrupted objects ids

Description:
Database contains corrupted object ids and therefore objects' functionality will be damaged
Please consult support how to fix the following corruption(s):
Table: asm Object name: A9F495C17-992D-4451-B3E0-FC35BE3F6D45 Object id: {9F495C17-992D-4451-B3E0-FC35BE3F6D4 ‚

I am unsure of

1. whether or not modifying the asm.C file is a good idea

2. Will the changes persist after upgrades/policy pushes etc?

Anyone have experience with this?

Mick

[Mick_OToole]

In the interest of completeness I thought I would follow up on my original query.

I backed up the asm.C file and made the changes that I suggested in my second post. 

The files were uploaded to Checkpoint and I received notification this morning that my environment is ready for upgrade.

I can only assume that my hunch was correct to modify this asm.C file and I have not had any ill effects in our environment.

I'm going to chalk this down as a win and move on.

I hope this information might be helpful for others in the future.

Mick

[Tomer_Sole · Accepted solution]

I can confirm to you that fixing asm.C in the case of corrupted asm objects is the right thing to do. Asm is where the IPS settings and protections are stored at (in pre-R80 Management). For equivalent data on R80 and above Management use the API commands. 

Hope this helps

[Mick_OToole]

Thanks Tomer,

I actually filled in the resolution earlier today but my comment is still being moderated so hasn't been published.

I appreciate the feedback.

Mick