Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Bradley_Fillo
Employee Alumnus
Employee Alumnus

Odd behaviour when using external IoCs - Feeds are successful, then partial, then fail completely...

Hi everyone,

Hi everyone,

I have a partner who is working with external IOC feeds on a 5x00 device.

He is using the test feeds in SK132193 and they exhibit the behaviour shown in the screenshots I have attached.  That is, at first they load successfully, then after about 30 minutes they report a partial failure, and then a complete failure to load.

He has verified there are no further external devices inhibiting communications, that he has installed the HFs according to the SK, and so on. 

Thank you for any help.  I have searched all of Support Centre, read all of the SKs I could find, and also run it past additional Check Point engineers to no avail.

Best regards,

-Brad

 

Screenshot 1.pngPartial failure.png

 

Full failure.png

0 Kudos
3 Replies
PhoneBoy
Admin
Admin

Perhaps as a separate thing I would manually fetch the feed using curl or similar periodically with a unique output file name.
This would allow you to see if there is a delta between the files you receive initially and subsequent ones.
If it's the same output that "worked initially" then started failing, that's obviously bad.
If there's something different in the file, then we need to see what's different and how that might be impacting import.
In any case, I highly recommend engaging the TAC with this.
0 Kudos
Bradley_Fillo
Employee Alumnus
Employee Alumnus

Thanks Phoneboy!  I have a TAC ticket opened.

I appreciate your help (as always)!

0 Kudos
Vladimir
Champion
Champion

@Bradley_Fillo , please post your findings here, when you'll get to the bottom of this issue. I'd like to try using external IoCs myself and will be keeping an eye on this thread.

 

Thank you,

Vladimir

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events