GAIA WebUi Failed to receive updates from Check Point Download Center. Please verify a valid license

[CEEJAY]

I am running R82 in my Check Point Firewall. I want to download hotfix via CPuse, but then this warning prompts at the top of webui and the "Check for Updates" is not working, I am sure that my gateway has internet connection, but my gateway can't resolve ping using domain like ping yahoo.com, I also can't ping the checkpoint.com. But I can ping to 8.8.8.8. Has anyone experienced the same issue? 

[the_rock]

I had that issue about a month ago and it happened out of the blue. I ended up adding another loopback interface, gave it random IP, assigned an eval using that IP address and then it worked fine.

[CEEJAY]

Will try this one. Does this issue only not reaching the checkpoint cloud via CPuse or the other updates are included like for the IPS and App Control? TIA

[the_rock]

I recall all else worked fine, no issues...updates, pings, curl_cli, routing, etc...ONLY issue was exactly what you had mentioned.

[emmap]

This is related to the CRL bug, you will need to install this fix manually to fix CPUSE. If you were planning on updating the JHF you should manually download and import/install that first else the CRL fix will block it.

https://support.checkpoint.com/results/sk/sk184766

Edit: I just re-read and saw that your device can't do DNS, not sure that that would be related to CRL but the rest of it could be. Sounds like you need to troubleshoot the network connectivity to your configured DNS servers?

[CEEJAY]

Hello @emmap. At first that is my initial assumption, but after installing the CRL fix, it does not disappear and still can't check for updates. 

[Daniel_Hainich]

iam running r82 management with take 60 and CRL_VALIDATION Hotfix Take 5. cpuse is working without any problems.

which dns servers you are using? check your logs if you can reach them.

[CEEJAY]

@Daniel_Hainich I am using google dns since it is only a lab environment. My gateway currently running take 44, maybe I'll try to install JHF take 60 then CRL Hotfix. 

[Daniel_Hainich]

as @emmap wrote, check your network settings. dns should work also with take 44 / without hotfix. whats on with the log? does your policy allow dns to google?

[CEEJAY]

Based on logs, looks like it is intermittent, I already installed the Take 44 CRL Hotfix since it includes that Check Point Updates and Services issue may occur, but it does not resolve the issue.

[StackCap43382]

What is the full error in the installer logs?

Does it contain "Connection Error, FDT - Unexpected error code"?

[Max_Frankl]

Please be aware that you will need to remove the hotfix of take 44 before moving to take 60 otherwise you will get a conflict.

[CEEJAY]

I am using google DNS since it is only a lab environment.

[emmap]

I think you need to troubleshoot this DNS problem before worrying about making CPUSE work. What devices are in path that might be blocking it?

[CEEJAY]

@emmap actullay there is still no conenected device in the gateway. I just finished the First time Wizard Configuration and trying to install hotfix using cpuse, btw my policy is set to any-any since it is only a lab environment.

[emmap]

What do you mean there are no connected devices, how is it getting internet access to ping out?

[CEEJAY]

Ohh what I mean is my lab is only in VM, but the next-hop is the firewall here in my working space, but I verified that the connection from my lab going to the internet is allowed. 

[Martijn]

Hi,

Can you run the following in expert mode?

First:

curl_cli -v -k https://updates.checkpoint.com

The -k option ignores invalid certificates.

Then try

curl_cli -v https://updates.checkpoint.com

Can you share the results?

Also, is the CPUSE agent up-to-date? If not, update it manually,

Martijn

[CEEJAY]

Hello @Martijn Yes, the DA is updated. I attached the result of the curl command.

[Marc_Schoemehl]

Same issue here. With the -k option it's ok, with -v not.

CRL_VALIDATION Hotfix for R82 is installed on both Gateways and the Management Server (R82 Take 60).

Is there a solution for this available ?

[majkel]

Newly upgraded to R82 take 60 and IPS and Antibot is alerting it cant connect to updates.checkpoint.com.
Ran curl_cli commands without CRL validation and its working. resolving is also working.
HCP in attached screenshot show me this:

[Daniel_Hainich]

did you installed the crl patch? https://support.checkpoint.com/results/sk/sk184766

[majkel]

Nope. we would like to wait until its included in future jhf.

Funny thing is that they were up to date after upgrade. 

[majkel]

Upon upgrading is it renewing the IPsec and internal certificates automatically ?
Checking ipsec certificate it still the old generated before upgrade. Or is this not relevant ?

[Martijn]

Hi,

I would advice to install the hotfix. Just as a test to see if this solves your issue.

Martijn

[majkel]

Would this hotfix make a workaround for future installations of release JHF ?

[Martijn]

Mike,

I assume this hotfix will be merged into any future JHF is this is needed.

Sometimes you can install a new JHF directly on a system with a seperate hotfix. But sometimes you need to uninstall the hotfix before installing a new JHF.

Always perform a verify before installing a hotfix/JHF and read the release notes.

Martijn 

[majkel]

Thanks!

[JozkoMrkvicka]

It depends if issue fixed in private portfix is already included in JHF you are trying to install.

If yes, you will not get any warning/error during CPUSE update of JHF, since issue is already part of JHF. The private portfix will be removed from cpinfo -y all output.

If issue in private portfix is not yet included in JHF, you get warning and installation of JHF will be blocked.

[CEEJAY]

@Mar 

Just an update. The CPuse is now working.  I installed the Recommended JHF take 60 and the relevat CRL for this take. I don't know if the CRL fix fix the issue, because it does not take effect immediately after installing the CRL fix, but it is the only thing I've done in my gateway. Anyways, it is working now. Thanks to everyone for your help.