cpisp_update script does not work on R81.10?

[Blason_R]

Hello,

According to sk25152, it is necessary to make modifications to the cpisp_update script in order to manage static NAT when ISP Redundancy is enabled. However, during my troubleshooting process, I discovered that this script is not compatible with R81.10 and is not supported by the sk article either.

Due to the absence of the dynobj_cache table in R81.10, it is not possible to make the necessary decision. Therefore, I am curious about the alternative methods available for controlling Static NAT when ISP redundancy is enabled.

 TIA

Blason R

[PhoneBoy]

As far as I know, this script is still valid.
In any case, it's probably worth engaging the TAC.

[Blason_R]

Nope it is not - That exact an issue I faced this morning and I tried flushing the dynobj_cache table and it says no such table exists. That means this script will not work

[the_rock]

I have custom script R&D gave me last year for R81.10, can send it to you if you prefer, not sure if it would work though.

Andy

[Blason_R]

Perhaps by examining the script, one may gain an understanding, as it is a straightforward bash script.

[the_rock]

Below is the link to it, not sure if you need to create an account to get it

Andy

https://andybee.sharefile.com/d-s9916ebbac8924613aba43487841be395

[Blason_R]

That is right - yeah.

It is not allowing me download and it needs a account.

[the_rock]

If you can send me your email in direct message, I can provide the link that way, and for that you 100% dont need an account.

Andy

[Blason_R]

Sent

[the_rock]

you should have it now, I sent it back

Andy

[Blason_R]

Got it - Thanks.

So just replace the entire script with this one?

[the_rock]

Yes sir. Make sure to backup the original file of course.

Andy

[the_rock]

Any luck?

[Blason_R]

Havent had a chance to replicate it. Let me do that in a day or two and revert

[the_rock]

K, no worries, take your time, hope it works.

Andy

[dede79]

have same issue.....so the script was changed and no sk telling us that?

Customers having R81 still work....fresh setup under R81.20 no chance (HA....manual nat)

[the_rock]

Message me directly, I will send it to you. I have no clue if it was changed...I cant be 100% sure, but I would say 90% it was not modified. The only reason why we got it was due a client having really weird problem described in below post.

Best,

Andy

https://community.checkpoint.com/t5/Security-Gateways/Policy-push-overwrote-default-route-on-cluster...

[the_rock]

Responsed to your message mate. Ping me back if you need clarification.

Best,

Andy

[dede79]

Update from TAC: sk25152 not supportet from R81.10 upwards. Supportet workaround would be using manual nat rules with zone in destination field.

[pedkha]

Hi, but how should we do it? do we still need to update the script? if we add zone to destination what will be the translated source field in the NAT rule, we have 2 addresses for  ISP

[Michael_Able]

Are there any news to this? The sk mentions the versions R80.40 (EOS), R81 (EOS), R81.10, R81.20. Is the sk updated and the script works for R81.10 and above?

[PhoneBoy]

As far as I know, this script is still supported.
If it's not working, I suggest involving TAC.