API disabled on R81 management server

[Scott_Paisley]

We recently upgraded both our management servers to R81

One is a hardware appliance, one is a VM.

On the VM, the API status appears as Unknown during start up, and then shows as disabled.

On the hardware, it shows as enabled.

We can restart it on the VM and it runs fine, but why does it not start automatically?

[_Val_]

Hi @Scott_Paisley please make sure you performed all actions mentioned here: https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_SecurityManagement_AdminGuide/Topi...

[Scott_Paisley]

Yes. The documentation mentions enabling the API, then says it is enabled or disabled automatically. We have more than 4GB RAM.

This was all working prior to the R81 upgrade.

[_Val_]

The VM MGMT station, is it secondary? It yes, please perform the failover, make sure API is once again enabled via SmartConsol, publish session, and run api restart on CLI

[_Val_]

Also, API should only be active on your primary/active server. That might be the main cause of the observed situation.

[Scott_Paisley]

We are running on our Active/Secondary server.

This worked fine on R80.40

[_Val_]

Please elaborate

[Scott_Paisley]

We failed over to our secondary management server, so it is currently the active box.

We have been running that way for over a year. On R80.40 the API started automatically. On R81 it does not.

[_Val_]

So, if I understand correctly, you are currently running the secondary management as active. Did you try to re-activate API on it, from SmartConsole, as mentioned above?

Did you try enabling api from the CLI? Run the following:

api start

api reconfigure

api restart

and check if it stays UP after those commands. 

[Scott_Paisley]

There is no enable option in smartconsole. see screenshot attached.

We can start from the CLI. I will try the commands listed

[_Val_]

You are right, in R81 the API start is automatic. Did you originally install your VM with just 4 GB of RAM?

[Scott_Paisley]

No, it always had more than 8GB

[_Val_]

Okay, try the CLI. If it is still disabled after reboot, please open a support call.

[Scott_Paisley]

No change. After a restart the API state is disabled until I restart it manually.

[_Val_]

Okay, that's too bad. Please take it with TAC

[Omer_Kleinstern]

Hi @Scott_Paisley ,

Can you run the following commands:

mgmt_cli show api-settings -r true -d "System Data" -f json | jq '."automatic-start"'

$CPDIR/bin/cpprod_util CPPROD_GetValue Products MGMTAPI 1

Thanks,

Omer

[Scott_Paisley]

# mgmt_cli show api-settings -r true -d "System Data" -f json | jq '."automatic-start"'
true

# $CPDIR/bin/cpprod_util CPPROD_GetValue Products MGMTAPI 1
Failed to find the value

[Omer_Kleinstern]

Please open a TAC case for further investigation.

[Scott_Paisley · Accepted solution]

TAC were able to resolve the issue.

There was a problem with one of the files on the server

[PhoneBoy]

What files did they precisely fix?
Did they give you an SK?

[Scott_Paisley]

/opt/CPshrd-R81/registry/HKLM_registry.data

They gave me a custom file, no SK.