IPS Update problem after upgrading to R80.10

[Alejandro_Lansa]

Hi

This week I have successfully upgraded our Management Server from R77.30 to R80.10. Gateways are still in R77.30. Everything works fine, but when I try to update the IPS package I receive the error “IPS Update Failed”. I have the same error message updating using the Smart Console or the security management server. It seems that it downloads the update successfully but it fails on the installation.

The Log File $FWDIR/log/cpm.elg show the following errors

26/07/18 10:58:56,042 ERROR internal.operation.OperationSvcImpl [qtp335532636-92]: caught exception "null" from class java.lang.NullPointerException

26/07/18 10:58:56,042 ERROR coresvc.internal.FwmSvcImpl [qtp335532636-92]: Error updating 96 object(s) from set.

26/07/18 10:58:56,042 ERROR internal.operation.OperationSvcImpl [qtp335532636-92]: caught exception "null" from class java.lang.NullPointerException

26/07/18 10:58:56,043 ERROR infrastructure.logging.DefaultExceptionLoggerHandlerImpl [qtp335532636-92]: incident [109177d7-0ec9-4655-886c-922359bbe9c6]:

26/07/18 10:58:56,043 ERROR dleserver.internal.DefaultExceptionMapper [qtp335532636-92]: Internal runtime error

Hat anybody experienced similar Problems?

[Dan_Sommerman]

Hi Alejandro, I just saw this with another customer.  You may need to follow the steps below to update the licenses: 

To download the Service Contract File:

1. Log into https://usercenter.checkpoint.com/usercenter/index.jsp.
2. Click "Assets/Info".
3. Click "Download Contract File" under "Tools" option.
4. In the section titled "Service Contract File Download", select the Account(s) you need your Service Contract File for.
5. Select "Email File" or "Download Now".

To install the Service Contract File via SmartUpdate:

1. Log into SmartUpdate
2. From the menu ,  select "Licenses & Contracts", select 'Update Contract > Import File'
3. Browse to the directory where the file is located and click 'Open'
4. The file will be added to the respective certificate key(s)
5. To verify the file has been installed properly, run 'cplic print' on the Security Gateway, and you should now see the contract information.

For additional information and assistance with downloading and installing your Service Contract File, please refer to SecureKnowledge document sk33089, "What is a Service Contract File?".

If you are unable to install the Service Contract File using SmartUpdate or it has not been installed properly, two additional methods may be used to install the file:

1. If running in a distributed environment (gateway/management server are installed different servers), run the following command in Expert mode on the Security Gateway (firewall): contract_util mgmt

Or

2. Save the file locally on the Security Gateway (firewall) and run the following command:

cplic contract put -o <filename>.xml

Finally, verify if the file was successfully installed, run 'cplic print' on the command line.

[Tomer_Sole]

Hi Alejandro,

We want to prevent this from happening,

To do that, we would need you to open a service request: Check Point User Center - Customer Portal for Licensing, Support and Account Management 

Opening a service request is also available directly from SmartConsole whenever a problem occurs: Cool Feature: Open a Service Request from SmartConsole 

And this way, we will be able to release a Jumbo Hotfix which in case of IPS Update failure due to expired contract, the app will say - "please renew your contract".

Let me know if you have any question regarding the support request process.

[Alejandro_Lansa]

Hi Dan and Tomer and thanks for your answers, but by now I have not reinstalled the service contracts.

I have opened a service request and the support team has provided me the Hotfix “fw1_wrapper_HOTFIX_R80_10_HF_228_GA_FULL.tgz”. After the patch installation IPS Update works fine, I can see the new protections in Smart Console and the policy install on gateways works fine.  Everything seems correct, but I still have a large list of errors in the cpm.elg during IPS Upgrade. The support is still working to fix this behavior.

[Tomer_Sole]

Something about "many errors in cpm.elg" - we get them with normal use as well. Please do not have those as indicators to problems alone. Many of them are false-positive. If something isn't working and the direct error message that you see on the screen is not clear enough, cpm.elg will not necessarily help you. It is better to contact support and send them the files that they need. Please believe we are all about self-help tools but at this point cpm.elg is not a good helper.

[Alejandro_Lansa]

That was also the answer from the support Team. The Management Server works without Problems, we close the ticket, and today we will upgrade 2 gateways.