Forcing External Network Feed Checks

[AntE]

Hello there!

I'm trying to figure out if there is a way to force a gateway to check a configured External Network Feed before the next scheduled Check. For instance, if the feed object is configured with the default 60 minute check interval, and there was an update to the feed that occurred in between checks that we wished to be enforced immediately, is there a way to force the gateway to perform an ad hoc feed check? In our case, the gateway and management environment are running R81.20.

I apologize if this topic has already been covered, or if my question is posted in the wrong location, but I haven't seen anything in the documentation, and I couldn't find anything posted about this topic in the forums.

Thank you!

[the_rock]

Very good question actually. Personally, Im not aware of any way to do so, but I could be mistaken.

Andy

[Timothy_Hall]

Pretty sure this command will do what you want:

$FWDIR/bin/ioc_feeder -f

[AntE]

Ok, thank you very much for the information!

I did run across this in the sk132193 - What is the "Custom Intelligence Feeds" feature? article, but I wasn't sure if it would work with an External Network Feed configuration. I'll test it to see if it works.

Thanks again!

[the_rock]

It does work, I tested it in the lab. I thought maybe you can do this from smart console object, but does not appear to be the case. Ostencibly, that was my impression, but been some time since I "fiddled" with it in smart dashboard : - )

[AntE]

Interesting, I did some testing yesterday and wasn't able to get it to work. I also tried the "Test Feed" button on the SmartConsole Feed object just in case that would run a feed check, but that didn't seem to work for me either.

Here's what I did:

1. Before any changes to the feed file on the web server, I performed a "Feed Test" of the feed object in the SmartConsole to confirm that the our POC was still working. The test was successful.
2. I ran dynamic_objects -efo {Name Of Feed} on the gateway and confirmed the returned results matched what was publish on the feed server's web page.
3. I ran tail -f -n 20 {Name Of Feed} $FWDIR/log/efo_error.elg on the gateway to determine when the next scheduled feed check would occur. Next scheduled check wasn't for another 30 mins or so.
4. I added a new IP to the feed file on the web server and browsed to the feed to verify that the updates were published.
5. I ran $FWDIR/bin/ioc_feeder -f on the gateway.
6. I ran dynamic_objects -efo {Name Of Feed} on the gateway and confirmed that the new IP added to the feed page was not present in the gateway output.
7. I performed a "Feed Test" of the feed object in the SmartConsole. The test was successful.
8. I ran dynamic_objects -efo {Name Of Feed} on the gateway and confirmed that the new IP added to the feed page was not present in the gateway output.
9. After about 30 mins or so, I ran tail -f -n 20 {Name Of Feed} $FWDIR/log/efo_error.elg on the gateway to confirm if the gateway performed its scheduled feed check. It had.
10. I ran dynamic_objects -efo {Name Of Feed} on the gateway and confirmed that the new IP added to the feed page was present in the gateway output.

I'm not sure if my testing procedures are correct, or if maybe I messed something up, so I'm planning to test again today to see if the results are the same.

Anyway, thank you very much for testing and the information! 😄

[the_rock]

Those look right to me.

Andy

[the_rock]

You can also do below.

Andy

[Expert@R82:0]# /opt/CPsuite-R82/fw1/bin/ioc_update_now
Update Success
[Expert@R82:0]#

[AntE]

Sweet! I'll try this out later this afternoon.

Thank you!

[the_rock]

Let us know the results.

Andy

[AntE]

Hello again, Andy!

I tested using /opt/CPsuite-R81.20/fw1/bin/ioc_update_now just a bit ago, and while I got the "Update Successful" message, I didn't see the feed updates in the dynamic_objects -efo {Name Of Feed} gateway output.

Looking at the efo_error.elg logs on the gateway, I see the following repeat during every scheduled feed check:

[Timestamp][PCC_Internal_Feed]: EFO_FEED> get_domain_from_url: called with URL {Feed Name}/
[Timestamp][PCC_Internal_Feed]: EFO_FEED> get_domain_ips: called with name {Feed Name}
[Timestamp][PCC_Internal_Feed]: EFO_FEED> validate_feed_url: resolved feed URL is {Feed IP}/

I'm wondering if there is a way to manually kick off the EFO_FEED> get_domain_from_url and EFO_FEED> get_domain_ips processes.

[the_rock]

Hey,

I can do some more tests in the lab Sunday and let you know. Personally, to me at least, if you think about it logically, sounds like whatever scripts are in $FWDIR/bin is what is available, but I could be mistaken, would not be first OR last time haha

Andy

[AntE]

Ok, yeah that makes sense. I'll do some more testing as well.

Thank you, I really appreciate the help with all of this!

[the_rock]

Glad we can help.

Have a nice weekend.

Andy