No SFTP any longer only Aspera in Service Requests

[Christian_Opitz]

Hello,

as CP Partner we have to handle cases for many customers. Now I got the information in an Service Request that SFTP Accounts for uploading should be no longer used: "Unfortunately, SFTP account can only be provided if an issue occurs while uploading the files through the browser."

This means we have to transfer all requested files to us as first step and upload them afterwards to you via browser (altough it is faster via Aspera Plugin if you can use it but I don't like uploading gb via browser).

This is very impractical in particular at big files e.g. Crash Dumps and also at many files in folders. When using an account with limiting rights for scp transfer you will also have to copy it to another folder and change file rights or change a oot user to bash to have access to all folders each time.

Before we were able to use sftp command (if SFTP Acc was created), cpinfo -s (should also not used) or earlier cp_uploader directly on the gateway or at least at a customer system with internet access but so we always need additional a browser cause this is no longer possible from a check point system itself.

This is complex, bandwith intensive and needs more time for us.

[Arne_Boettger]

Hello,

found your post while searching for the sk178326. We sometimes had success asking for an SFTP account instead, especially for uploading files directly from the affected devices. We, too, are very unhappy with the move to Aspera, especially because our Microsoft Defender for Endpoint complains about the version CheckPoint uses, because it is outdated.

[Jan_Kleinhans]

We also don't like the Aspera. We cannot use the plugin because of internal policy. So uploads of GBytes takes very long and sometimes the uploads don't even work and you have to reupload or ask for an sftp account.

Maybe Checkpoint should evaluate the Tool and change to another one. 

[Henrik_Noerr1]

We *never* use that plugin - and it would not be allowed by our organisation.

To rub it in - our jump hosts does not have internet access. So I would also need to offload the data to the jump host, then to my desktop (where I am not allowed to have this data) and then upload the data to Check Point. That would only slow me down and make me breach compliance guardrails. 

We always use the cpinfo tool every time to upload data, and expect it to continue to work. This also means that support can never ever find the files, and we need to guide them.

Regards,

Henrik

[Jan_Kleinhans]

We have exactly the same architecture. cpinfo upload is always "lost". But it would be the easiest way of uploading files.

[Duane_Toler · Accepted solution]

Aye, I often had the same issue with uploads being "lost".

I got frustrated and opened a TAC case and got hold of someone who gave me some "inside scoop" on what happens when uploading giant files with "cpinfo -s <SR> -x -n -f ..".  Apparently, the larger files do take a LOOOOOONG time to process on their end, and they are then copied over to a different server that the TAC folks can access.  It also matters if your file is going to the server in Dallas or Ottawa, versus where the TAC engineer is.  They may need to check the opposite server.

I don't wanna write out the names of these hosts here, but TAC folks on the inside should know which-is-which.

This is a process that could be improved, however.  If for no reason other than to help the TAC folks need to do less "gymnastics" of their own.  This would help us, the support partners, feel better about using the tools we're told to use (cpinfo -x -s -n -f) knowing that TAC is gonna get what we throw at them.

[Henrik_Noerr1]

ahh it makes perfect sense now! 🙂

Thanks

[G_W_Albrecht]

I always get SFTP credentials as upload in UserCenter is limited and Aspera not allowed - UC upload is possible but slower without Aspera. For server_migrate export you will not use Aspera but SFTP !