I am observing an odd behavior with a set of firewalls running on R77.30. All these firewalls are managed by the same SMS. App control and URL filtering blades are enabled on all these firewalls, and licenses are valid.
While I started to investigate because we had issues in blocking certain Websites, I identified that firewall's appi update status doesn't show anything on firewalls where we have an isssue.
[Expert@FW1:0]# cpstat appi -f update_status
Next update description:
The working firewalls show the DB version and the update status, licenses are pretty clear.
[Expert@FW1:0]# cpstat appi -f subscription_status
Subscription status: valid
Subscription expiration date: Sun Mar 31 00:00:00 2019
Subscription description: Contract is up to date.
[Expert@FW1:0]# cat appi_status.C
:urlf_rad_status_description ("URL Filtering engine is up and running")
:app_subscription_expiration_date ("Sun Mar 31 00:00:00 2019")
:app_subscription_description ("Contract is up to date.")
:urlf_subscription_expiration_date ("Sun Mar 31 00:00:00 2019")
:urlf_subscription_description ("Contract is up to date.")
I ran curl_cli to updates.checpoint.com and secureupdates.checkpoint.com. Don't see any issues, except these errors.
* servercert: cp_verify_certificate returned: CRL_ERR_DOWNLOAD
* servercert: Warning:
Failed to download CRL from: http://crl.godaddy.com/gdroot-g2.crl
Not sure if the above output is related, because we have a firewall which can't event resolve these URLs but has necessary DB updated. Tried enabling/disabling App and URL blades, didn't change anything. Installed the latest jumbo, though I did not have enough evidence to proceed, but that did not change anything either.
Has anyone seen this behavior before.
P:S - This behavior is seen on quite a set of firewalls, about 10 Cluster pairs to be specific.