Anti-Bot response with wrong status code

[gurowar]

Good day all,

I was wondering if anyone had a similar issue with there smartconsole, I have a pair of 16200 firewalls, managing them via smartconsole. I noticed in the logs that I am getting a lot of Anti-bot system alerts.  It seems to start up around 6am and stops about 4-5pm. I haven't looked at all the messages but the 2 or 3 I opened up today are:

Response with wrong status code., check /opt/CPsuite-R81.10/fw1/log/rad_events/Errors/flow_75937_42293907 For more details

[rad_curl_task.cpp:123] CRadCurlTask::run: [ERROR] Response status = 504

not sure what that means but that is all I see in the logs

Failed to Decrypt CP Site Response., check /opt/CPsuite-R81.10/fw1/log/rad_events/Errors/flow_75937_42306671 For more details

Flow Termination Status:Failed!

FlowError=Failed to Decrypt CP Site Response.

[rad_keyset.cpp:49] CRadRepositoryContaineData::getRadEncKeyByServiceKey: [INFO] no key found for requested service: malware+0returning default

[rad_decrypted_response_task.cpp:134] CRadDecryptedResponseTask::decrypt: [ERROR] response size is 1232944' limit to 1000000
[rad_decrypted_response_task.cpp:80] CRadDecryptedResponseTask::getResponseString: [ERROR] failed to decrypt response 0xdd054518
[rad_response_task.cpp:67] CRadResponseTask::run: [ERROR] can not get response string

What key is this looking for?

Going to check the rest of the logs but the 3 I opened, 2 of them has that Response with wrong status code and the other one Failed to Decrypt CP Site Response

Is this a problem  or is this normal?

Thank you in advance!!

[Lesley]

Please share $FWDIR/conf/rad_conf.C from relevant gateway

[gurowar]

Here is the output

[Expert@Firewall01:0]# cat $FWDIR/conf/rad_conf.C
(
:urlfs_service_check_seconds (7200)
:amws_service_check_seconds (1800)
:cpu_cores_as_number_of_threads (false)
:number_of_threads (0)
:threads_to_cores_ratio (0.334)
:minimal_resources_usage_ratio (0.2)
:number_of_threads_fast_response (0)
:number_of_threads_slow_response (0)
:queue_max_capacity (2000)
:debug_traffic (false)
:use_dns_cache (true)
:dns_cache_timeout_sec (2)
:use_ssl_cache (true)
:cert_file_name ("ca-bundle.crt")
:cert_type ("CRT")
:ssl_version ("TLSv1_0")
:ciphers ("TLSv1")
:autodebug (true)
:timeout_events (false)
:normal_flow_events (false)
:log_timeouts (false)
:log_errors (true)
:number_of_reports (512)
:max_repository_multiplier (20)
:flow_timeout (6)
:excessive_flow_timeout (120)
:transfer_timeout_sec (15)
:max_flows (2000)
:max_pc_in_reply (0)
:retry_mechanism_on (true)
:max_retries (25)
:retry_peroid_mins (15)

)
[Expert@Firewall01:0]#

[Lesley]

You can start with below. If you don't trust open TAC case and they can give you custom advise (every setup is different)

Edit file on both cluster members and save it. After change: rad_admin stop ; sleep 5 ; rad_admin start

Sleep is important!

urlfs_service_check_seconds (7200)
:amws_service_check_seconds (7200)
:cpu_cores_as_number_of_threads (false)
:number_of_threads (0)
:threads_to_cores_ratio (0.334)
:minimal_resources_usage_ratio (0.2)
:number_of_threads_fast_response (0)
:number_of_threads_slow_response (0)
:queue_max_capacity (4000)
:debug_traffic (false)
:use_dns_cache (true)
:dns_cache_timeout_sec (2)
:use_ssl_cache (true)
:cert_file_name ("ca-bundle.crt")
:cert_type ("CRT")
:ssl_version ("TLSv1_0")
:ciphers ("TLSv1")
:autodebug (false)
:timeout_events (false)
:normal_flow_events (false)
:log_timeouts (false)
:log_errors (true)
:number_of_reports (512)
:max_repository_multiplier (20)
:flow_timeout (6)
:excessive_flow_timeout (120)
:transfer_timeout_sec (15)
:max_flows (3000)
:max_pc_in_reply (0)
:retry_mechanism_on (true)
:max_retries (25)
:retry_peroid_mins (15)

[gurowar]

Hi Lesley,

Will try and keep you posted I have a call with checkpoint tomorrow as well but let me try your suggestion first, then see what they say.

Keep you posted but for now thank you!!!!

[gurowar]

Just an update on this, talked to Checkpoint and what we did was 

sed -i 's/:autodebug (true)/:autodebug (false)/' $FWDIR/conf/rad_conf.C
rad_admin stop ; sleep 5 ; rad_admin start

didn't have to make any changes to the other fields in the rad_conf.C file as I am told this should cause an auto calculation for rest of the values in the file.  Made the changes an hour ago and so far haven't seen an Anti-Bot alert but we will see.

[gurowar]

Good day all,

Happy Friday!!!  Just to give an update on this, the only change that was recommended was to change 

:autodebug (false)

and nothng else because by doing this, this change will automatically update the rest of the values in the rad.config.C. So I what was recommended but nothing changed  in the past day.  Not sure if that was because it didn't work or the way it is configured is the ways it supposed to be, minus the autodebug.  So what I did was updated just 2 things that suggested here to and left autodebug to false to see if if will auto configure as they say.   But we are making progress there is a lot less Auto-Bot messages scrolling in, hopefully updating the 2 setting will drop it more but we will see.

[Expert@Firewall01:0]# cat $FWDIR/conf/rad_conf.C
(
:urlfs_service_check_seconds (7200)
:amws_service_check_seconds (5400)
:cpu_cores_as_number_of_threads (false)
:number_of_threads (0)
:threads_to_cores_ratio (0.334)
:minimal_resources_usage_ratio (0.2)
:number_of_threads_fast_response (0)
:number_of_threads_slow_response (0)
:queue_max_capacity (4000)
:debug_traffic (false)
:use_dns_cache (true)
:dns_cache_timeout_sec (2)
:use_ssl_cache (true)
:cert_file_name ("ca-bundle.crt")
:cert_type ("CRT")
:ssl_version ("TLSv1_0")
:ciphers ("TLSv1")
:autodebug (false)
:timeout_events (false)
:normal_flow_events (false)
:log_timeouts (false)
:log_errors (true)
:number_of_reports (512)
:max_repository_multiplier (20)
:flow_timeout (6)
:excessive_flow_timeout (120)
:transfer_timeout_sec (15)
:max_flows (2000)
:max_pc_in_reply (0)
:retry_mechanism_on (true)
:max_retries (25)
:retry_peroid_mins (15)

[gurowar · Accepted solution]

Good day all,

Just wanted to update on this, looks like changing the following in rad_conf.C 

:amws_service_check_seconds (5400)

:queue_max_capacity (4000)

:autodebug (false)

has quieted the Anti-bot logs, not completely but quit a bit.  So far today we only have 3, also perhaps I misunderstood the engineer but turning off autodebug, in due time it would auto configure teh settings in rad_conf.C file but since I made the changes last week Friday, they are still the same.  I would assume it would have auto correct by now. I will monitor the rest of the week and if there is any changes or update will let you know.  But for now this seems to have fixed my issue.

Thank you, All!!

Warren

[Itall]

queue_max_capacity  must be greater than   max_flows in ratio 1:2    sk182136 - RAD process unexpectedly exits when a cluster failover or a Security Gateway reboot occur...

[JP_Rex]

Please also check

sk182494 - Anti-Bot Blade generates error logs with the reason "Failed to Decrypt CP Site Response"

Regards

Peter