Issues with Anti-Bot Updates

[RemoteUser]

Hey mates,
Is anyone else experiencing problems with the anti-bot updates? I’ve got a few clusters all showing red because of this issue...

[TJ_Aus]

Error: Update failed. Contract entitlement check failed. Could not download https://updates.checkpoint.com/WebService/services/DownloadMetaDataService. Server error occurred.

I tried to curl_cli and that failed from our appliances

Nothing about outages here:   Check Point Services Status Status

[_Val_]

Can you share some screenshots? Did you check if this is not a connectivity issue, as per sk83520?

[RemoteUser]

I’ve got several checkpoints around the world (Asia, Europe, and so on) and all of them are running into the same problem. I tried checking one at random using the curl_cli, but everything seemed fine… very strange.

[Danny]

Check Point Status is green.
What is our ccc tool showing for your Anti-Bot blade?
Have you checked sk83520 or what is our CP Services Check showing?

curl_cli [--proxy <IP_or_HostName:Port>] -v http://cws.checkpoint.com/Malware/SystemStatus/type/short

[TJ_Aus]

It is happening at multiple locations from multiple (50+) appliances (no changes our end). Might be something happening CP end

[Marcel_Gramalla]

We have the same issue since yesterday evening (multiple locations). Today morning it was working again but not broken again. Also true for all other blade updates (IPS for example).

[Alex_Hofstee]

We are experiencing the same (in The Netherlands). I've had it with AV/AB and IPS. Usually it is resolved again upon the next try. This is a bit on/off since yesterday. I assumed CP Cloud is having issues. We don't seem to have categorization issues so I'm not too worried at this point.

[RemoteUser]

Okay, I'm not alone, that makes me feel better. 😆

[the_rock]

You are definitely not alone brother, it appears to be more wide spread. One way to fix this issue (at least that I found) is update manually ips and urlf updates via smart console threat prevention settings, seems that takes care of anti bot issue as well.

Andy

[Grigoriy]

Seems like this. We (in Uzbekistan, Central Asia) have the same issues with IPS Updates, but only on one node in the two-nodes cluster.

[VIKAS1]

We are facing below error today again and again. without doing any changes it's getting rectify and after some hours again we are getting same error.

Anti-Bot & Anti-Virus

Error: Update failed. Contract entitlement check failed. Could not download "https://updates.checkpoint.com/WebService/services/DownloadMetaDataService". Server error occurred.

Threat Emulation

Error: Update failed: The Security Gateway cannot download the file.The Security Gateway cannot connect to the Internet. We recommend that you check the network connection and proxy settings

[Chris_Atkinson]

Please see the existing discussion here:

https://community.checkpoint.com/t5/General-Topics/Issues-with-Anti-Bot-Updates/m-p/255487#M42945

Typically you would monitor this page and report any issue with TAC otherwise:

https://status.checkpoint.com/

[VIKAS1]

Hi, 

Today from Morning we have not faced any issue.

[Christoph]

Also seeing this around multiple installations and customers. Likely starting at around 08/19/25 7:30pm. It's not failing all the time, but often. Multiple blades affected (Threat emulation, AB, AV).

[TJ_Aus]

I checked Smart Console again this morning, and it looks good for us. A check of the updates looks good too 

# cpstat antimalware -f update_status

AB Update status: up-to-date
AB Update description: Gateway is up to date. Database version: 2507130909. Package date: Sun Jul 13 16:00:00 2025
.
AB Next update description: The next update will be run as scheduled.
AB DB version: 2507130909
AV Update status: new
AV Update description: Gateway was updated with database version: 2508202033. Package date: Wed Aug 20 16:00:00 2025
.
AV Next update description: The next update will be run as scheduled.
AV DB version: 2508202033

# cpstat urlf -f update_status

Update status: up-to-date
Update description: Gateway is up to date. Database version: 18082501.
Next update description: The next update will be run as scheduled.
DB version: 18082501

# cpstat appi -f update_status

Update status: up-to-date
Update description: Gateway is up to date. Database version: 18082501.
Next update description: The next update will be run as scheduled.
DB version: 18082501

[erezya · Accepted solution]

Hi Everyone,

The issue has now been resolved. Yesterday, our software update service experienced a temporary high load, which caused some update requests to fail intermittently. We’ve scaled the service to handle the demand, and everything is working as expected again.

Thank you for your patience.

[RemoteUser]

Luckily, thanks a lot for the update! I was wondering why it wasn’t reflected here:
status
It usually is.

[the_rock]

I still see an issue on one of my lab gateways, but could be just that fw problem.

Andy

[Alex_Hofstee]

For us it isn't completely resolved either. Yesterday it was a lot worse but today its intermittent/random one node. Which one differs and I have seen it on a few different clusters. It's not as bad but still happening.

Update: at this moment all four clusters have one node with the error. 

[the_rock]

I just did manual update in the lab and was fine afterwards, so to me, looks like its not fully resolved yet, but for the most part.

Andy

[the_rock]

Just checked with one customer and its still showing same error on both on their clusters, but each one shows 1 member, not both.

Andy