Odd behaviour when using external IoCs - Feeds are successful, then partial, then fail completely...

[Bradley_Fillo]

Hi everyone,

Hi everyone,

I have a partner who is working with external IOC feeds on a 5x00 device.

He is using the test feeds in SK132193 and they exhibit the behaviour shown in the screenshots I have attached.  That is, at first they load successfully, then after about 30 minutes they report a partial failure, and then a complete failure to load.

He has verified there are no further external devices inhibiting communications, that he has installed the HFs according to the SK, and so on. 

Thank you for any help.  I have searched all of Support Centre, read all of the SKs I could find, and also run it past additional Check Point engineers to no avail.

Best regards,

-Brad

[PhoneBoy]

Perhaps as a separate thing I would manually fetch the feed using curl or similar periodically with a unique output file name.
This would allow you to see if there is a delta between the files you receive initially and subsequent ones.
If it's the same output that "worked initially" then started failing, that's obviously bad.
If there's something different in the file, then we need to see what's different and how that might be impacting import.
In any case, I highly recommend engaging the TAC with this.

[Bradley_Fillo]

Thanks Phoneboy!  I have a TAC ticket opened.

I appreciate your help (as always)!

[Vladimir]

@Bradley_Fillo , please post your findings here, when you'll get to the bottom of this issue. I'd like to try using external IoCs myself and will be keeping an eye on this thread.

Thank you,

Vladimir