Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Vladimir
Champion
Champion
Jump to solution

Loss of HTTPS and SSH access to ClusterXL members, help?

After three days of building client's CXL with SMS on 5400s and Smart-1 410, suddenly could not connect to either WebUIs or SSH into the gateways. Since I've been working all day on crafting the AppC/URLF layer, I did not notice when this become an issue.

Smartlog showing events that sounds like "connection dropped by multiportal infrastructure" or some such.

In "Rules Matched" I am seeing two accepts, one from Access Control Policy and one from AppC/URLF.

The only blades enabled on cluster are Firewall, IPSEC, AV/AB/IPS/Monitoring/URLF/AppC.

So I do not expect the 443 being shared with anything else.

For giggles, tried changing portal to listen on 10443, sk115732, but no dice.

 

Management laptop, SMS and Mgmt interfaces of the gateways are on the same subnet and switch.

No policy installation / SIC issues.

Has anyone seen this before and are willing to share the remedies?

Thank you,

Vladimir

0 Kudos
1 Solution

Accepted Solutions
Vladimir
Champion
Champion

The mystery is partially solved: The Implicit Cleanup Rule in App Control and URLF layer set to "Drop" was causing the issue.

Surprisingly, it was not obvious in case of WebUI: Matched Rules were showing both, the Network and the App Control accepting traffic, yet connectivity was failing.

Thankfully, SSH attempts showed that Implicit Cleanup in App Control was dropping it, which led me to look in to either changing Implicit rule to Accept or adding Explicit rule on top of the policy for management traffic.

I am a little peeved, that the management traffic to infrastructure components is not exempt from App Control.

View solution in original post

8 Replies
Danny
Champion Champion
Champion

I had a similar issue last year when I stopped cpsizeme via Ctrl-C which caused the /var/tmp folder to be removed. Once I logged out I could never log back in to the system via ssh, console nor WebUI. I had to start from a Linux LiveCD, mount the partitions and recreate the /var/tmp folder manually.

0 Kudos
Vladimir
Champion
Champion

Wow! Was it on a physical appliance or VM?

I am a bit doubtful that this is same case as it is happening on both cluster members and I was not running and interrupting any processes on those.

That being said, I'll connect via RS232 (serial console access is working), and take a look at the /var/tmp.

Thank you for the suggestion. 

0 Kudos
Vladimir
Champion
Champion

The mystery is partially solved: The Implicit Cleanup Rule in App Control and URLF layer set to "Drop" was causing the issue.

Surprisingly, it was not obvious in case of WebUI: Matched Rules were showing both, the Network and the App Control accepting traffic, yet connectivity was failing.

Thankfully, SSH attempts showed that Implicit Cleanup in App Control was dropping it, which led me to look in to either changing Implicit rule to Accept or adding Explicit rule on top of the policy for management traffic.

I am a little peeved, that the management traffic to infrastructure components is not exempt from App Control.

PhoneBoy
Admin
Admin

I think most of the Check Point management traffic is (assuming you have implicit rules enabled) 

SSH and WebUI access isn't included as part of this and must be explicitly allowed.

0 Kudos
Vladimir
Champion
Champion

I guess CP was not kidding about "Small Office Appliances" in the Global Properties:)

PhoneBoy
Admin
Admin

I wasn't even aware that was a Global Property Smiley Happy

0 Kudos
Tomer_Sole
Mentor
Mentor

Compliance Blade has a validation for that.

Vladimir
Champion
Champion

Well, I would still like for someone at CP to take a look at the WebUI portion of it. As was mentioned in the original post, "in case of WebUI: Matched Rules were showing both, the Network and the App Control accepting traffic, yet connectivity was failing" 

 

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events