Anti-Bot/Anti-Virus update failed. Update failed. Contract entitlement check failed

[wrios12]

Hello CheckMates,

I'm having the following problem with this error: "Update failed. Error checking contract rights. The gateway cannot access the Internet ('https://updates.checkpoint.com/WebService/services/DownloadMetaDataService'). Check connectivity and proxy settings".

I have an R81.20 HFA TAKE 92 cluster and I have validated my internet connection, which has access to updates.checkpoint.com, however, the error persists.

Could you help me? I have already opened a case with the TAC but have not made any progress in solving the problem.

[Lesley]

Is this issue active on both cluster members? How long is this issue active? Did it start after upgrade or reboot? 

[wrios12]

Hello, yes. The problem started two months ago and is applying to both gateways.

The TAC suggested us to update the take (HFA) to the latest one to solve it but the problem persists.

[the_rock]

Can you see if same shows up when you run exact command like below?

[Expert@R82:0]# curl_cli -k updates.checkpoint.com
Page not found![Expert@R82:0]#

Also, do you see the same if you right click on the object in smart console and go to monitor?

Andy

[wrios12]

I ran the command and it says ''page not found”.

[the_rock]

Looks right. Where are you located? We can do remote little later on if allowed. I can spare some time on my break.

Andy

[wrios12]

In what time frame are you free and what time zone are you in?

My time zone is GMT-4, so I can connect in advance to the gateways.

[the_rock]

I believe we are GMT-5 (its EST). Its almost 10 am here.

Andy

[wrios12]

I understand, please indicate your break time for us to connect and review

[the_rock]

Just message me directly and we will connect. Im good for 12.30 pm est, so 2.5 hours from now.

Andy

[wrios12]

I have already written to you by direct message

[the_rock]

Yes, already responded, lets correspond there and I will update once we do remote.

Andy

[the_rock]

Hey guys,

Just spoke with Edward and here are my notes. Based on all I now know, Im fairly confident this is not CP issue, but @wrios12 , if you can verify with ISP provider, let us know what they say.

Andy

RS notes:

remote session

error -> Anti-Bot/Anti-Virus update failed. Update failed. Contract entitlement check failed

tested connectivity with curl_cli -k, verified routing, licences, contract file -> all good

opened "old school" sv monitor -> same error

TAC asked them to delete and re-create entitlement file, restart cpd process, but no change

We disabled av and ab. installed policy

re-enabled -> updates still fail, though error is back

Edward also mentioned 2nd cluster with exact same, one internal and one extarnal with exact SAME problem

sounds like it could be Internet line issue, not the fw itself

They may do packet capture on the router itself and check further

[the_rock · Accepted solution]

Hey everyone,

Appears issue was indeed related to ACL on ISP router, as @wrios12 advised me after we had remote sesison. Seems this was actually blocking the connection to Akamai.

Great job @wrios12 , glad it all works fine now.

Thanks again for your time.

Andy