Install Policy Presets not working on R80.20

[JozkoMrkvicka]

Hello guys,

It looks like something is not working in regards of new feature introduced in MDS R80.20 - Install Policy Presets (IPP).

The issue is that this feature is not working in case you want to create IPP based on Policy Package:

Once there is time to do policy push, it did nothing. No error, no progress, just nothing.

Can someone take a look on this ?

Thank you.

[Tomer_Sole]

Please open a support ticket so that Check Point Support will be able to assist. This shouldn't have happened.

[Nurit_Gr]

Hi Jozko,

Sorry for the late reply. You are probably experiencing this since these policy packages weren’t previously installed on the gateway (and using install policy presets requires that the user first installs the policy from the local domain).

Unfortunately, in this case there is no proper indication in the UI. I will work on adding an SK for that and consider adding an alert in the UI.

In the meantime, if this is not the case - please open a support ticket as Tomer suggested so that we can look into it.

[JozkoMrkvicka]

Hi Nurit,

Thank you very much for the answer.

It might be the case, as the policy wasnt installed at all.

I will try to replicate the issue with working cluster and revert back if this is really the issue.

[JozkoMrkvicka]

Hi,

So it doesnt have any relation to the fact that the policy wasnt installed.

I did manual policy installation which was OK, then I tried to schedule policy installation first by targets (it was successfull) and second by policy package (which was not performed at all):

[Nurit_Gr]

Hi Jozko,

Please open a ticket with support so we can have all the info and be able to investigate.

Thanks.

[Maria_Pologova]

We faced the same issue on our R80.20 Take87 MDM. It works indeed when policy installation is chosen by Gateways and doesn't when it's chosen by Policy Package.

cpm.elg says the following:

24/08/19 14:15:00,006 INFO policy_package.install_policy.PolicyInstallationScheduleManager [DefaultQuartzScheduler_Worker-6]: Starting scheduled install policy::run()
24/08/19 14:15:00,006 INFO policy_package.install_policy.SchedulePolicyInstallationSvcImpl [DefaultQuartzScheduler_Worker-6]: execute install policy by settings 4da321dd-1fb9-44c6-b695-10693d264f9c
24/08/19 14:15:00,011 INFO policy_package.install_policy.SchedulePolicyInstallationSvcImpl [DefaultQuartzScheduler_Worker-6]: start install policy settings : test
24/08/19 14:15:00,011 INFO policy_package.install_policy.SchedulePolicyInstallationSvcImpl [DefaultQuartzScheduler_Worker-6]: Start going over policy packages list.
24/08/19 14:15:00,015 INFO policy_package.install_policy.SchedulePolicyInstallationSvcImpl [DefaultQuartzScheduler_Worker-6]: No gateways nor policies to install for: InstallPolicyMdsSettings{owner=null, assignGlobalPolicy=false, bypassInstallPolicyInCaseOfFail=false}

[Maria_Pologova]

Indeed, policy installation works when chosen by Gateways, but not policy packages.

As @JozkoMrkvicka said in a duplicated thread for the same subject, it seems to be fixed in R80.30.

Meanwhile cpm.elg on our MDM R80.20 Take 97 says the following during the run:

24/08/19 14:15:00,006 INFO policy_package.install_policy.PolicyInstallationScheduleManager [DefaultQuartzScheduler_Worker-6]: Starting scheduled install policy::run()
24/08/19 14:15:00,006 INFO policy_package.install_policy.SchedulePolicyInstallationSvcImpl [DefaultQuartzScheduler_Worker-6]: execute install policy by settings 4da321dd-1fb9-44c6-b695-10693d264f9c
24/08/19 14:15:00,011 INFO policy_package.install_policy.SchedulePolicyInstallationSvcImpl [DefaultQuartzScheduler_Worker-6]: start install policy settings : test
24/08/19 14:15:00,011 INFO policy_package.install_policy.SchedulePolicyInstallationSvcImpl [DefaultQuartzScheduler_Worker-6]: Start going over policy packages list.
24/08/19 14:15:00,015 INFO policy_package.install_policy.SchedulePolicyInstallationSvcImpl [DefaultQuartzScheduler_Worker-6]: No gateways nor policies to install for: InstallPolicyMdsSettings{owner=null, assignGlobalPolicy=false, bypassInstallPolicyInCaseOfFail=false}