Re: Threat Emulation alert

az26

Hi, I have a Cluster XL setup with 2 physical GW appliances. One of these GWs keep getting an alert with:

Blade: Threat Emulation, Description: Communication error: could not connect to cloud.

The alert disappears and comes back without me doing anything.

If I ping from this GW to for example checkpoint.com it the ping goes through with no problem.

Is there anyway to get this issue resolved and for the alert not to appear again?

Martijn

Hi,

When this happens, you can check if the gateway reach the Threat Emulation services at Check Point.

#curl_cli -v https://te.checkpoint.com

What is the results of this test?

What version are you running? Are you up-to-date with hotfixes and the latest SmartConsole version?

Regards,
Martijn

az26

We are running R82 Take 103
On the security GW where the alert is NOT coming:

[Expert@CP-A:0]# curl_cli -v https://te.checkpoint.com
* Rebuilt URL to: https://te.checkpoint.com/
*   Trying 2a05:d018:27b:f924:e75a:b548:2271:5068...
* TCP_NODELAY set
* Connected to te.checkpoint.com (2a05:d018:27b:f924:e75a:b548:2271:5068) port 4                                                                 43 (#0)
* ALPN, offering http/1.1
* *** Current date is: Tue Jul 14 09:02:06 2026
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* err is -1, detail is 2
* *** Current date is: Tue Jul 14 09:02:06 2026
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS alert, unknown CA (560):
* err is -1, detail is 1
* errdetail=0x1416f086
ERR_lib_error_string: SSL routines
ERR_func_error_string: tls_process_server_certificate
ERR_reason_error_string: certificate verify failed
ERR_error_string: error:1416F086:SSL routines:tls_process_server_certificate:ce                                                                 rtificate verify failed
* SSL certificate problem: unable to get local issuer certificate
* Closing connection 0
curl: (60) SSL certificate problem: unable to get local issuer certificate
More details here: https://curl.haxx.se/docs/sslcerts.html

curl failed to verify the legitimacy of the server and therefore could not
establish a secure connection to it. To learn more about this situation and
how to fix it, please visit the web page mentioned above.
[Expert@CP-A:0]#

-------------------------------------------------------------------------------

On the GW where the alert keep coming:

[Expert@CP-B:0]# curl_cli -v https://te.checkpoint.com
* Rebuilt URL to: https://te.checkpoint.com/
* Trying 2a05:d018:27b:f924:e75a:b548:2271:5068...
* TCP_NODELAY set
* Connected to te.checkpoint.com (2a05:d018:27b:f924:e75a:b548:2271:5068) port 443 (#0)
* ALPN, offering http/1.1
* *** Current date is: Tue Jul 14 09:03:04 2026
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* err is -1, detail is 2

And it just stops there

Martijn

Hi,

I forgot to include the CA bundle in the command. Can you try again with:

curl_cli -v https://te.checkpoint.com --cacert $CPDIR/conf/ca-bundle.crt

Martijn

az26

Thanks Martijn for your reply!
here comes the output:

[Expert@CP-B:0]# curl_cli -v https://te.checkpoint.com --cacert $CPDIR/conf/ca-bundle.crt
* Rebuilt URL to: https://te.checkpoint.com/
* Trying 2a05:d018:27b:f920:8121:1114:abe0:83c9...
* TCP_NODELAY set
* Connected to te.checkpoint.com (2a05:d018:27b:f920:8121:1114:abe0:83c9) port 443 (#0)
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /opt/CPshrd-R82/conf/ca-bundle.crt
CApath: none
* *** Current date is: Tue Jul 14 10:19:13 2026
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* err is -1, detail is 2
* *** Current date is: Tue Jul 14 10:22:17 2026
* err is -1, detail is 5
* errdetail=0x0
ERR_lib_error_string: (nil)
ERR_func_error_string: (nil)
ERR_reason_error_string: (nil)
ERR_error_string: error:00000000:lib(0):func(0):reason(0)
* OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to te.checkpoint.com:443
* Closing connection 0
curl: (35) OpenSSL SSL_connect: SSL_ERROR_SYSCALL in connection to te.checkpoint.com:443
[Expert@CP-B:0]#

-----------------------------------------------

The other GW where the alert doesn't appear:

[Expert@CP-A:0]# curl_cli -v https://te.checkpoint.com --cacert $CPDIR/conf/ca-bundle.crt
* Rebuilt URL to: https://te.checkpoint.com/
* Trying 2a05:d018:27b:f920:8121:1114:abe0:83c9...
* TCP_NODELAY set
* Connected to te.checkpoint.com (2a05:d018:27b:f920:8121:1114:abe0:83c9) port 443 (#0)
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /opt/CPshrd-R82/conf/ca-bundle.crt
CApath: none
* *** Current date is: Tue Jul 14 10:17:17 2026
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* err is -1, detail is 2
* *** Current date is: Tue Jul 14 10:17:17 2026
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, [no content] (0):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_128_GCM_SHA256
* ALPN, server accepted to use http/1.1
* servercert: Activated
* servercert: crl_download_timeout: 10
* servercert: crl_weak_validation: 1
* servercert: Calling cp_verify_certificate
* servercert: cp_verify_certificate returned: CURLE_OK
* Server certificate:
* subject: CN=*.checkpoint.com
* start date: Jun 14 00:00:00 2026 GMT
* expire date: Dec 28 23:59:59 2026 GMT
* verifyhost: No 'trusted CN' provided.
* subjectAltName: host "te.checkpoint.com" matched cert's "*.checkpoint.com"
* verifyhost: Alternative name '*.checkpoint.com' matches the destination hostname.
* issuer: C=US; O=Amazon; CN=Amazon ECDSA 256 M04
* SSL certificate verify ok.
* servercert: Finished
* TLSv1.3 (OUT), TLS app data, [no content] (0):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS app data, [no content] (0):
< HTTP/1.1 404 Not Found
< Date: Tue, 14 Jul 2026 08:17:18 GMT
< Content-Type: text/plain; charset=utf-8
< Content-Length: 21
< Connection: keep-alive
< Strict-Transport-Security: max-age=31536000; includeSubDomains; preload
< X-Request-Start: t=1784017038.575
<
* Connection #0 to host te.checkpoint.com left intact
default backend - 404[Expert@CP-A:0]#

Martijn

It seems there is something wrong on CP-B when it comes to SSL. Did you tried to reboot the appliance?

have you checked sk184864 - Threat Emulation blade status in SmartConsole shows "Communication error: could not conne...

If the issue remains, I would advice to contact TAC.

Regards,
Martijn
If these are not y

az26

I doesn't seem to be the same problem we are having. When I run the command "tecli show cloud quate" I get a different output than the one in the SK.

However, I tried applying the solution suggested in this SK but it didn't make any difference, I returned back as it was.

The alert seems to come and disappear periodically. It looks like every half an hour it disappears and then comes back right away 😕

Any suggestions?

Martijn

At this stage, I would advice to contact TAC.

az26

Thanks Martijn 🙂

az26

I've just noticed that the problem only occurs on the standby GW. Is that the normal behavior?
I did a failover between the GWs and the problem started occurring on the other GW.
The CluterXL is setup with Active/standby

WiliRGasparetto

Since the error only occurs on the standby member, I would check to see if it is a false positive alert by doing the following:

1. Access the Gateway via SSH or console.
2. Run the command below to view the Threat Prevention component versions:
cpstat threat-prevention -f update_status

This command displays the status and update versions of the Threat Prevention engines.

3. For specific details on each blade (IPS, Anti-Bot, Anti-Virus), use:
cat $FWDIR/conf/updates/VersionInfo.xml

Or, for IPS:

ips stat

az26

Thanks WiliRGasparetto for your reply!

the command with "threat-prevention" doesn't seem to correct.

[Expert@CP-A:0]# cpstat threat-prevention -f update_status
No product has flag 'threat-prevention'
[Expert@CP-A:0]# cpstat threat-emulation -f update_status

TE Update Status: up-to-date
TE Update Description: Gateway is up to date.

[Expert@CP-A:0]#

Also, the updates folder doesn't exist under conf directory. So I've googled how to find the threat emulation version I fond the this command: cat /opt/CPsuite-R82/fw1/teCurrentPack/te_ver.ini
In both GWs the output is 60.990002541

We are running R82 Take 107.

WiliRGasparetto

So, you aren't actually facing a TE update error on the gateway; it's just an "aesthetic" issue. There are no newer hotfix versions available, and since it isn't impacting your infrastructure, I would calmly open a ticket with Check Point TAC—but the versions match and the asset is up to date, so you don't have a real update error.

WiliRGasparetto

It looks like an aesthetic error to me, but which version is your GW running, and which Jumbo Hotfix is installed? Have you checked the Threat Prevention version?

You can check this directly from the GW using this command:
cpstat threat-prevention -f update_status

to see if both are on the same version.

Are you a member of CheckMates?

Threat Emulation alert