SecureXL - Alternative method to identify rule causing templates to be disabled

[Michael_Horne]

Hello,

Is there are alternative way to identify exactly what is causing Accept Templates to be disabled.  The output from the "fwaccel stat" has a  output display issue and does not show me the information.

fwaccel stat

All I can see is "Layer ---", there is a missing carriage return and then "Drop Templates".

Many thanks,

Michael

[G_W_Albrecht]

Which version do you use ? Afaik, this is the only way to display these layers. Even looks like an issue for TAC to me...

[Michael_Horne]

ZZZZZZZZ> cpinfo -y all

This is Check Point CPinfo Build 914000202 for GAIA
[IDA]
No hotfixes..

[MGMT]
HOTFIX_R80_30_JUMBO_HF_MAIN Take: 111

[CPFC]
HOTFIX_R80_30_JUMBO_HF_MAIN Take: 111

[FW1]
HOTFIX_R80_30_JUMBO_HF_MAIN Take: 111

FW1 build number:
This is Check Point's software version R80.30 - Build 078
kernel: R80.30 - Build 076

[SecurePlatform]
HOTFIX_R80_30_JUMBO_HF_MAIN Take: 111

[DIAG]
No hotfixes..

[PPACK]
HOTFIX_R80_30_JUMBO_HF_MAIN Take: 111

[CVPN]
No hotfixes..

[CPUpdates]
BUNDLE_CPINFO Take: 50
BUNDLE_INFRA_AUTOUPDATE Take: 19
BUNDLE_DEP_INSTALLER_AUTOUPDATE Take: 13
BUNDLE_R80_30_JUMBO_HF_MAIN_SC Take: 132
BUNDLE_R80_30_JUMBO_HF_MAIN Take: 111

[CPinfo]
No hotfixes..

[AutoUpdater]
No hotfixes..

[CPDepInst]
No hotfixes..

[Timothy_Hall]

Is the firewall being managed by MDSM/Provider-1, and if so are there global rules being inserted at the top of the policy?  Also please provide the output of enabled_blades.

[Michael_Horne]

Hello,

The cluster is not managed as part of a MDM environment, so there are not global rules. the following blades are activated:

Blades

Regards,

Michael

[Timothy_Hall]

Try temporarily disabling Anti-bot, reinstall policy, then check Accept templating status again.

[Michael_Horne]

Hello Unfortunately no difference after disabling Anti-Bot blade.

[_Val_]

Are you using any of those in the policy: dhcp-request' / 'dhcp-reply' / 'dhcpv6-request' / 'dhcpv6-reply' / 'dhcpv6-relay?

If yes, look here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[Timothy_Hall · Accepted solution]

Strange, it looks like fwaccel stat is not displaying its output correctly.  Please provide the output of fwaccel templates -s and fwaccel templates -S, as I suspect Accept templating is actually working.

[Michael_Horne]

Thanks, this solved the display issue.

[Timothy_Hall · Accepted solution]

Ah here we go, your policy layer name must be longer than 32 characters.  Shorten it and the fwaccel stat output will start working correctly:

sk145533: "Layer ---" is displayed instead of specific layer name and rule number in output of 'fwac...