Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Pearl

Loss of HTTPS and SSH access to ClusterXL members, help?

Jump to solution

After three days of building client's CXL with SMS on 5400s and Smart-1 410, suddenly could not connect to either WebUIs or SSH into the gateways. Since I've been working all day on crafting the AppC/URLF layer, I did not notice when this become an issue.

Smartlog showing events that sounds like "connection dropped by multiportal infrastructure" or some such.

In "Rules Matched" I am seeing two accepts, one from Access Control Policy and one from AppC/URLF.

The only blades enabled on cluster are Firewall, IPSEC, AV/AB/IPS/Monitoring/URLF/AppC.

So I do not expect the 443 being shared with anything else.

For giggles, tried changing portal to listen on 10443, sk115732, but no dice.

 

Management laptop, SMS and Mgmt interfaces of the gateways are on the same subnet and switch.

No policy installation / SIC issues.

Has anyone seen this before and are willing to share the remedies?

Thank you,

Vladimir

0 Kudos
1 Solution

Accepted Solutions
Highlighted
Pearl

Re: Loss of HTTPS and SSH access to ClusterXL members, help?

Jump to solution

The mystery is partially solved: The Implicit Cleanup Rule in App Control and URLF layer set to "Drop" was causing the issue.

Surprisingly, it was not obvious in case of WebUI: Matched Rules were showing both, the Network and the App Control accepting traffic, yet connectivity was failing.

Thankfully, SSH attempts showed that Implicit Cleanup in App Control was dropping it, which led me to look in to either changing Implicit rule to Accept or adding Explicit rule on top of the policy for management traffic.

I am a little peeved, that the management traffic to infrastructure components is not exempt from App Control.

View solution in original post

8 Replies
Highlighted
Pearl

Re: Loss of HTTPS and SSH access to ClusterXL members, help?

Jump to solution

I had a similar issue last year when I stopped cpsizeme via Ctrl-C which caused the /var/tmp folder to be removed. Once I logged out I could never log back in to the system via ssh, console nor WebUI. I had to start from a Linux LiveCD, mount the partitions and recreate the /var/tmp folder manually.

0 Kudos
Highlighted
Pearl

Re: Loss of HTTPS and SSH access to ClusterXL members, help?

Jump to solution

Wow! Was it on a physical appliance or VM?

I am a bit doubtful that this is same case as it is happening on both cluster members and I was not running and interrupting any processes on those.

That being said, I'll connect via RS232 (serial console access is working), and take a look at the /var/tmp.

Thank you for the suggestion. 

0 Kudos
Highlighted
Pearl

Re: Loss of HTTPS and SSH access to ClusterXL members, help?

Jump to solution

The mystery is partially solved: The Implicit Cleanup Rule in App Control and URLF layer set to "Drop" was causing the issue.

Surprisingly, it was not obvious in case of WebUI: Matched Rules were showing both, the Network and the App Control accepting traffic, yet connectivity was failing.

Thankfully, SSH attempts showed that Implicit Cleanup in App Control was dropping it, which led me to look in to either changing Implicit rule to Accept or adding Explicit rule on top of the policy for management traffic.

I am a little peeved, that the management traffic to infrastructure components is not exempt from App Control.

View solution in original post

Highlighted
Admin
Admin

Re: Loss of HTTPS and SSH access to ClusterXL members, help?

Jump to solution

I think most of the Check Point management traffic is (assuming you have implicit rules enabled) 

SSH and WebUI access isn't included as part of this and must be explicitly allowed.

0 Kudos
Highlighted
Pearl

Re: Loss of HTTPS and SSH access to ClusterXL members, help?

Jump to solution

I guess CP was not kidding about "Small Office Appliances" in the Global Properties:)

Highlighted
Admin
Admin

Re: Loss of HTTPS and SSH access to ClusterXL members, help?

Jump to solution

I wasn't even aware that was a Global Property Smiley Happy

0 Kudos
Highlighted

Re: Loss of HTTPS and SSH access to ClusterXL members, help?

Jump to solution

Compliance Blade has a validation for that.

Highlighted
Pearl

Re: Loss of HTTPS and SSH access to ClusterXL members, help?

Jump to solution

Well, I would still like for someone at CP to take a look at the WebUI portion of it. As was mentioned in the original post, "in case of WebUI: Matched Rules were showing both, the Network and the App Control accepting traffic, yet connectivity was failing" 

 

0 Kudos