brief URLF database issue earlier today? lots of 'Inactive Sites' categorizations

[Lloyd_Braun]

Is anyone else seeing a lot of 'Inactive Sites' categorizations today?  Looking up the site on the Check Point URL lookup, and the site seems to be categorized correctly.

I can hit the site from one of our edge clusters, but not the other, it appears to be cached as 'Inactive Sites' there. 

I have seen this with several websites today, like the URLF database was temporarily returning an 'Inactive Sites' categorization for a brief time, and stuck it in the cache on the gateway. Log history shows these sites categorized correctly through the gateways in the last few days.

[the_rock]

I have R81.20 https inspection lab, had not seen this issue today and I tested bunch of sites.

Best,

Andy

[Lesley]

No issues here. And what do you mean stuck in cache? You tried to clear it? I think the most common way is to force an update to the gateways. After the incorrect category is changed in the cloud of course. 

[Lloyd_Braun]

I don't want to make that dbedit change to force the cache to clear upon every policy installation.  Though I am considering it. Would be much better if we could just 'fw tab -x' a cache table to clear it, but that does not appear to be possible anymore.

A few sites that displayed this behavior today, seemed to be categorized as Inactive between 8am-12:45 eastern time:

bellmasonjars.com
trabble.com
viewcitation.com
govplus.com

I have checked history on some other sites and they were categorized correctly a few days to a week ago, then were 'Inactive' for a period of time today.

Maybe a one off, or I will have to dig in with support if the behavior continues.

Thanks!

[Lesley]

Normal procedure would be:

whitelist false-positive -> https://support.checkpoint.com/results/sk/sk98489

report to Check Point -> same SK

wait to be fixed and check if it is https://urlcat.checkpoint.com/urlcat/

force update on gateways (cache clear not needed) or wait for next update interval (is set in Smartconsole). 

[the_rock]

Thats excellent advice @Lesley 

[Lloyd_Braun]

These were already classified correctly by Check Point by the time the service ticket was received, which is why I posted this, seemed like unusual behavior. At that point the datacenter that never saw the request classifies the site properly, while it is stuck in cache at the datacenter that the initial request traversed.

What do you mean by 'force update on gateways' ?   Are you saying reloading local database files (#rad_admin urlf update $FWDIR/appi/update/urlf_db.bin)  will clear the URLF cache so the categorization override steps are unnecessary?

[the_rock]

I think what @Lesley meant was to update the urlf database manually from smart console.

Andy

[Lloyd_Braun]

I have a 'Management Update' button that will immediately udpate management but the Security Gateway Updates are scheduled for every 2 hours, no way to force them from r81.20 smartconsole that I'm seeing.

[the_rock]

Just click exactly that

Andy

 

[the_rock]

This is from my Azure lab, when I click on that option

Andy