Checkpoint Management Server(Open) is not getting App & URL updates

[MaheshCheck]

Hello Everyone,

Could you please anyone help us to resolve App & URL updates issue in checkpoint management server.

Attached Error image.

[AkosBakos]

Did you try with tls 1.2 too?

[MaheshCheck]

Thanks but we cann't go back to TLS 1.2 as per security reasons

[AkosBakos]

If you do a tcpdump for this connection, what can you see in answer for hello? Maybe the server side does not answer in tls 1.3?

tls 1.3 is enabled on the gateway or on the mgmt?

akos

[MaheshCheck]

I don't understand that Why logs are updating on TLS v1.3 but I see TLS v1.2 is enabled on MGMT sever

[the_rock]

What do you see if you run below command?

Andy

[Expert@CP-MANAGEMENT:0]# curl_cli -k updates.checkpoint.com
Page not found![Expert@CP-MANAGEMENT:0]#

[AkosBakos]

What do you see here:

show ssl tls enabled

 Akos

[the_rock]

I also tested command @PhoneBoy ran in the lab in R81.20 and R82 lab and it answered on tls 1.3, so definitely no issues with updates site. 

Andy

[PhoneBoy]

What version/JHF are you attempting this on?
I can assure you that updates.checkpoint.com is answering on TLS 1.3, which suggests the problem is something specific to your environment.
See attached, run from an R82 gateway:

[Expert@R82-SA:0]# curl_cli -v -l --cacert /opt/CPshrd-R82/conf/ca-bundle.crt https://updates.checkpoint.com
* Rebuilt URL to: https://updates.checkpoint.com/
*   Trying 23.197.2.122...
* TCP_NODELAY set
* Connected to updates.checkpoint.com (23.197.2.122) port 443 (#0)
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*   CAfile: /opt/CPshrd-R82/conf/ca-bundle.crt
  CApath: none
* *** Current date is: Wed Nov 20 12:15:29 2024
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* err is -1, detail is 2
* *** Current date is: Wed Nov 20 12:15:29 2024
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Encrypted Extensions (8):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS change cipher, Change cipher spec (1):
* TLSv1.3 (OUT), TLS handshake, [no content] (0):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384
* ALPN, server accepted to use http/1.1
* servercert: Activated
* servercert: crl_download_timeout: 10
* servercert: crl_weak_validation: 1
* servercert: Calling cp_verify_certificate
* servercert: cp_verify_certificate returned: CURLE_OK
* Server certificate:
*  subject: CN=*.checkpoint.com
*  start date: Dec 31 11:43:57 2023 GMT
*  expire date: Jan 31 11:43:56 2025 GMT
* verifyhost: No 'trusted CN' provided.
*  subjectAltName: host "updates.checkpoint.com" matched cert's "*.checkpoint.com"
* verifyhost: Alternative name '*.checkpoint.com' matches the destination hostname.
*  issuer: C=BE; O=GlobalSign nv-sa; CN=GlobalSign GCC R3 DV TLS CA 2020
*  SSL certificate verify ok.
* servercert: Finished
* TLSv1.3 (OUT), TLS app data, [no content] (0):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, [no content] (0):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS app data, [no content] (0):
< HTTP/1.1 404 Not Found
< Content-Type: text/plain; charset=utf-8
< Content-Length: 15
< Server: awselb/2.0
< Date: Wed, 20 Nov 2024 18:16:07 GMT
< Connection: keep-alive
< 
* Connection #0 to host updates.checkpoint.com left intact
Page not found![Expert@R82-SA:0]# 

[MaheshCheck]

R81.20 Jumbo Hotfix Take 84

[Lesley]

Traffic not blocked on a firewall in front of mgmt? You see the traffic allowed there? NAT all good? System can access other URLs?