- CheckMates
- :
- Products
- :
- Quantum
- :
- Security Gateways
- :
- Re: Anti-Bot response with wrong status code
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page
Are you a member of CheckMates?
×- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Anti-Bot response with wrong status code
Good day all,
I was wondering if anyone had a similar issue with there smartconsole, I have a pair of 16200 firewalls, managing them via smartconsole. I noticed in the logs that I am getting a lot of Anti-bot system alerts. It seems to start up around 6am and stops about 4-5pm. I haven't looked at all the messages but the 2 or 3 I opened up today are:
Response with wrong status code., check /opt/CPsuite-R81.10/fw1/log/rad_events/Errors/flow_75937_42293907 For more details
[rad_curl_task.cpp:123] CRadCurlTask::run: [ERROR] Response status = 504
not sure what that means but that is all I see in the logs
Failed to Decrypt CP Site Response., check /opt/CPsuite-R81.10/fw1/log/rad_events/Errors/flow_75937_42306671 For more details
Flow Termination Status:Failed!
FlowError=Failed to Decrypt CP Site Response.
[rad_keyset.cpp:49] CRadRepositoryContaineData::getRadEncKeyByServiceKey: [INFO] no key found for requested service: malware+0returning default
[rad_decrypted_response_task.cpp:134] CRadDecryptedResponseTask::decrypt: [ERROR] response size is 1232944' limit to 1000000
[rad_decrypted_response_task.cpp:80] CRadDecryptedResponseTask::getResponseString: [ERROR] failed to decrypt response 0xdd054518
[rad_response_task.cpp:67] CRadResponseTask::run: [ERROR] can not get response string
What key is this looking for?
Going to check the rest of the logs but the 3 I opened, 2 of them has that Response with wrong status code and the other one Failed to Decrypt CP Site Response
Is this a problem or is this normal?
Thank you in advance!!
- Labels:
-
Gaia
-
Smart Console
Accepted Solutions
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Good day all,
Just wanted to update on this, looks like changing the following in rad_conf.C
:amws_service_check_seconds (5400)
:queue_max_capacity (4000)
:autodebug (false)
has quieted the Anti-bot logs, not completely but quit a bit. So far today we only have 3, also perhaps I misunderstood the engineer but turning off autodebug, in due time it would auto configure teh settings in rad_conf.C file but since I made the changes last week Friday, they are still the same. I would assume it would have auto correct by now. I will monitor the rest of the week and if there is any changes or update will let you know. But for now this seems to have fixed my issue.
Thank you, All!!
Warren
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please share $FWDIR/conf/rad_conf.C from relevant gateway
If you like this post please give a thumbs up(kudo)! 🙂
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Here is the output
[Expert@Firewall01:0]# cat $FWDIR/conf/rad_conf.C
(
:urlfs_service_check_seconds (7200)
:amws_service_check_seconds (1800)
:cpu_cores_as_number_of_threads (false)
:number_of_threads (0)
:threads_to_cores_ratio (0.334)
:minimal_resources_usage_ratio (0.2)
:number_of_threads_fast_response (0)
:number_of_threads_slow_response (0)
:queue_max_capacity (2000)
:debug_traffic (false)
:use_dns_cache (true)
:dns_cache_timeout_sec (2)
:use_ssl_cache (true)
:cert_file_name ("ca-bundle.crt")
:cert_type ("CRT")
:ssl_version ("TLSv1_0")
:ciphers ("TLSv1")
:autodebug (true)
:timeout_events (false)
:normal_flow_events (false)
:log_timeouts (false)
:log_errors (true)
:number_of_reports (512)
:max_repository_multiplier (20)
:flow_timeout (6)
:excessive_flow_timeout (120)
:transfer_timeout_sec (15)
:max_flows (2000)
:max_pc_in_reply (0)
:retry_mechanism_on (true)
:max_retries (25)
:retry_peroid_mins (15)
)
[Expert@Firewall01:0]#
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You can start with below. If you don't trust open TAC case and they can give you custom advise (every setup is different)
Edit file on both cluster members and save it. After change: rad_admin stop ; sleep 5 ; rad_admin start
Sleep is important!
urlfs_service_check_seconds (7200)
:amws_service_check_seconds (7200)
:cpu_cores_as_number_of_threads (false)
:number_of_threads (0)
:threads_to_cores_ratio (0.334)
:minimal_resources_usage_ratio (0.2)
:number_of_threads_fast_response (0)
:number_of_threads_slow_response (0)
:queue_max_capacity (4000)
:debug_traffic (false)
:use_dns_cache (true)
:dns_cache_timeout_sec (2)
:use_ssl_cache (true)
:cert_file_name ("ca-bundle.crt")
:cert_type ("CRT")
:ssl_version ("TLSv1_0")
:ciphers ("TLSv1")
:autodebug (false)
:timeout_events (false)
:normal_flow_events (false)
:log_timeouts (false)
:log_errors (true)
:number_of_reports (512)
:max_repository_multiplier (20)
:flow_timeout (6)
:excessive_flow_timeout (120)
:transfer_timeout_sec (15)
:max_flows (3000)
:max_pc_in_reply (0)
:retry_mechanism_on (true)
:max_retries (25)
:retry_peroid_mins (15)
If you like this post please give a thumbs up(kudo)! 🙂
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi Lesley,
Will try and keep you posted I have a call with checkpoint tomorrow as well but let me try your suggestion first, then see what they say.
Keep you posted but for now thank you!!!!
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just an update on this, talked to Checkpoint and what we did was
sed -i 's/:autodebug (true)/:autodebug (false)/' $FWDIR/conf/rad_conf.C
rad_admin stop ; sleep 5 ; rad_admin start
didn't have to make any changes to the other fields in the rad_conf.C file as I am told this should cause an auto calculation for rest of the values in the file. Made the changes an hour ago and so far haven't seen an Anti-Bot alert but we will see.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Good day all,
Happy Friday!!! Just to give an update on this, the only change that was recommended was to change
:autodebug (false)
and nothng else because by doing this, this change will automatically update the rest of the values in the rad.config.C. So I what was recommended but nothing changed in the past day. Not sure if that was because it didn't work or the way it is configured is the ways it supposed to be, minus the autodebug. So what I did was updated just 2 things that suggested here to and left autodebug to false to see if if will auto configure as they say. But we are making progress there is a lot less Auto-Bot messages scrolling in, hopefully updating the 2 setting will drop it more but we will see.
[Expert@Firewall01:0]# cat $FWDIR/conf/rad_conf.C
(
:urlfs_service_check_seconds (7200)
:amws_service_check_seconds (5400)
:cpu_cores_as_number_of_threads (false)
:number_of_threads (0)
:threads_to_cores_ratio (0.334)
:minimal_resources_usage_ratio (0.2)
:number_of_threads_fast_response (0)
:number_of_threads_slow_response (0)
:queue_max_capacity (4000)
:debug_traffic (false)
:use_dns_cache (true)
:dns_cache_timeout_sec (2)
:use_ssl_cache (true)
:cert_file_name ("ca-bundle.crt")
:cert_type ("CRT")
:ssl_version ("TLSv1_0")
:ciphers ("TLSv1")
:autodebug (false)
:timeout_events (false)
:normal_flow_events (false)
:log_timeouts (false)
:log_errors (true)
:number_of_reports (512)
:max_repository_multiplier (20)
:flow_timeout (6)
:excessive_flow_timeout (120)
:transfer_timeout_sec (15)
:max_flows (2000)
:max_pc_in_reply (0)
:retry_mechanism_on (true)
:max_retries (25)
:retry_peroid_mins (15)
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Good day all,
Just wanted to update on this, looks like changing the following in rad_conf.C
:amws_service_check_seconds (5400)
:queue_max_capacity (4000)
:autodebug (false)
has quieted the Anti-bot logs, not completely but quit a bit. So far today we only have 3, also perhaps I misunderstood the engineer but turning off autodebug, in due time it would auto configure teh settings in rad_conf.C file but since I made the changes last week Friday, they are still the same. I would assume it would have auto correct by now. I will monitor the rest of the week and if there is any changes or update will let you know. But for now this seems to have fixed my issue.
Thank you, All!!
Warren
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
queue_max_capacity must be greater than max_flows in ratio 1:2 sk182136 - RAD process unexpectedly exits when a cluster failover or a Security Gateway reboot occur...
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Please also check
sk182494 - Anti-Bot Blade generates error logs with the reason "Failed to Decrypt CP Site Response"
Regards
Peter