Anti-Bot response with wrong status code

[gurowar]

Good day all,

I was wondering if anyone had a similar issue with there smartconsole, I have a pair of 16200 firewalls, managing them via smartconsole. I noticed in the logs that I am getting a lot of Anti-bot system alerts.  It seems to start up around 6am and stops about 4-5pm. I haven't looked at all the messages but the 2 or 3 I opened up today are:

Response with wrong status code., check /opt/CPsuite-R81.10/fw1/log/rad_events/Errors/flow_75937_42293907 For more details

[rad_curl_task.cpp:123] CRadCurlTask::run: [ERROR] Response status = 504

not sure what that means but that is all I see in the logs

Failed to Decrypt CP Site Response., check /opt/CPsuite-R81.10/fw1/log/rad_events/Errors/flow_75937_42306671 For more details

Flow Termination Status:Failed!

FlowError=Failed to Decrypt CP Site Response.

[rad_keyset.cpp:49] CRadRepositoryContaineData::getRadEncKeyByServiceKey: [INFO] no key found for requested service: malware+0returning default

[rad_decrypted_response_task.cpp:134] CRadDecryptedResponseTask::decrypt: [ERROR] response size is 1232944' limit to 1000000
[rad_decrypted_response_task.cpp:80] CRadDecryptedResponseTask::getResponseString: [ERROR] failed to decrypt response 0xdd054518
[rad_response_task.cpp:67] CRadResponseTask::run: [ERROR] can not get response string

What key is this looking for?

Going to check the rest of the logs but the 3 I opened, 2 of them has that Response with wrong status code and the other one Failed to Decrypt CP Site Response

Is this a problem  or is this normal?

Thank you in advance!!

[Lesley]

Please share $FWDIR/conf/rad_conf.C from relevant gateway

[gurowar]

Here is the output

[Expert@Firewall01:0]# cat $FWDIR/conf/rad_conf.C
(
:urlfs_service_check_seconds (7200)
:amws_service_check_seconds (1800)
:cpu_cores_as_number_of_threads (false)
:number_of_threads (0)
:threads_to_cores_ratio (0.334)
:minimal_resources_usage_ratio (0.2)
:number_of_threads_fast_response (0)
:number_of_threads_slow_response (0)
:queue_max_capacity (2000)
:debug_traffic (false)
:use_dns_cache (true)
:dns_cache_timeout_sec (2)
:use_ssl_cache (true)
:cert_file_name ("ca-bundle.crt")
:cert_type ("CRT")
:ssl_version ("TLSv1_0")
:ciphers ("TLSv1")
:autodebug (true)
:timeout_events (false)
:normal_flow_events (false)
:log_timeouts (false)
:log_errors (true)
:number_of_reports (512)
:max_repository_multiplier (20)
:flow_timeout (6)
:excessive_flow_timeout (120)
:transfer_timeout_sec (15)
:max_flows (2000)
:max_pc_in_reply (0)
:retry_mechanism_on (true)
:max_retries (25)
:retry_peroid_mins (15)

)
[Expert@Firewall01:0]#

[Lesley]

You can start with below. If you don't trust open TAC case and they can give you custom advise (every setup is different)

Edit file on both cluster members and save it. After change: rad_admin stop ; sleep 5 ; rad_admin start

Sleep is important!

urlfs_service_check_seconds (7200)
:amws_service_check_seconds (7200)
:cpu_cores_as_number_of_threads (false)
:number_of_threads (0)
:threads_to_cores_ratio (0.334)
:minimal_resources_usage_ratio (0.2)
:number_of_threads_fast_response (0)
:number_of_threads_slow_response (0)
:queue_max_capacity (4000)
:debug_traffic (false)
:use_dns_cache (true)
:dns_cache_timeout_sec (2)
:use_ssl_cache (true)
:cert_file_name ("ca-bundle.crt")
:cert_type ("CRT")
:ssl_version ("TLSv1_0")
:ciphers ("TLSv1")
:autodebug (false)
:timeout_events (false)
:normal_flow_events (false)
:log_timeouts (false)
:log_errors (true)
:number_of_reports (512)
:max_repository_multiplier (20)
:flow_timeout (6)
:excessive_flow_timeout (120)
:transfer_timeout_sec (15)
:max_flows (3000)
:max_pc_in_reply (0)
:retry_mechanism_on (true)
:max_retries (25)
:retry_peroid_mins (15)

[gurowar]

Hi Lesley,

Will try and keep you posted I have a call with checkpoint tomorrow as well but let me try your suggestion first, then see what they say.

Keep you posted but for now thank you!!!!

[gurowar]

Just an update on this, talked to Checkpoint and what we did was 

sed -i 's/:autodebug (true)/:autodebug (false)/' $FWDIR/conf/rad_conf.C
rad_admin stop ; sleep 5 ; rad_admin start

didn't have to make any changes to the other fields in the rad_conf.C file as I am told this should cause an auto calculation for rest of the values in the file.  Made the changes an hour ago and so far haven't seen an Anti-Bot alert but we will see.