Threat Policy Install failed

[handiansudianto]

Hello,

I upgrade my checkpoint from 80.40 to 81.10 and after upgraded i got error below if i use latest IPS version, but if i use old IPS the threat policy is successfull.

Policy: Standard
Status: Failed
    - amw_load_copy_file_to_local: cpFileCopy() failed to copy file sd_updates
    - amw_load_copy_file_to_local: amw_load_copy_file_to_local() sd_updates failed from /opt/CPsuite-R81.10/fw1/tmp/install_policy/d381d0a2-9336-4e10-a181-32cbe182b6b0/FW1/conf/install_manager_tmp/ANTIMALWARE_CURRENTVERCMP/conf  to /opt/CPsuite-R81.10/fw1/state/local/AMW.tmp  dst file anme
    - amw_load_add_state_files: amw_load_copy_file_to_local() failed, file=sd_updates
    - amw_load: amw_load_add_state_files() failed
    - Operation was unsuccessful.

[the_rock]

 Just as a simple test, can you try uncheck IPS blade, push policy, recheck and then try again?

Andy

[handiansudianto]

without IPS enable, the threat policy install is successfully.

Now my IPS using version 635158746 , and if using version 635232122 threat policy is failed to install.

[the_rock]

Just tested in R81.10 and R81.20 with latest IPS package and worked fine, so has to be your environment. Can you run below command?

fw stat -b AMW

Are you using autonomous threat prevention possibly?

Andy

[the_rock]

Below is what Im referring to.

Andy

 

 

[HeikoAnkenbrand]

Hi @handiansudianto 

See sk167633 "Errors while loading Threat Prevention policy, Operation was unsuccessful" in the log.

Solution

Perform an IPS update on the Domain.

1. Log in to the Domain on the active CMA.

2. Select "Security Policies" tab and then Policy under Threat Prevention.

3. Click on "Updates" at the bottom and proceed with the IPS update. It can be done through client's internet connectivity or the Multi-Domain Managemet..

4. After the update is finished, push policy to the relevant Gateways and it should work now.

[the_rock]

I believe that was a;ready tried, but let @handiansudianto confirm.

[handiansudianto]

Hello, already try but still failed. Currently i open ticket to checkpoint support.

[Tal_Paz-Fridman]

Can you try to update IPS again to see if it solved the issue (it might be a mismatch in IPS versions).

[_Val_]

Please open a TAC case, if the problem is still there: https://help.checkpoint.com