Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Duane_Toler
MVP Silver
MVP Silver

config_system flaw

(i hope this board is a decent choice...)

First of all: thanks to the R&D folks for providing us with config_system! It's a huge help for automation, and I know you know that already. 🙂  Thanks!

 

I seem to have found a bit of a flaw in config_system.  I did have a minor error in syntax when I generated the FTW config (yes my fault).  However, the dry-run check did not detect the syntax error properly.

 

My config was:

 

# Install Security Gateway. 
install_security_gw=" true "

 

This was generated from my own Ansbile Jinja2 template, and I know I had the error there.  Notice the spaces inside the quotes.  Since dry-run didn't detect the error, my playbook continued to execute and ran the task to run config_system with the config file.

 

After 30 minutes of no progress, everything timed out and died.  config_system never really did anything.  I re-ran it manually, and it sat at "Configuring products":

[Expert@gaia_demo:0]#  /usr/bin/config_system  -f /home/admin/gaia.ftw.config 
dos2unix: converting file /home/admin/gaia.ftw.config to Unix format ...

Validating configuration file:	Done
Configuring OS parameters:	Done
Configuring products:		-

 

It was still running in the process-list:

  863 ?        S      0:00      \_ /opt/CPsuite-R80.40/fw1/Python/bin/python3 /var/tmp/ansible-tmp-1651184043.6572037-2564807-184818913965851/AnsiballZ_command.py
  865 ?        S      0:01          \_ /bin/bash /usr/bin/config_system -f /home/admin/gaia.ftw.config

 

I then looked at the config file for sanity and saw the erroneous spaces.  I fixed the config, ran it again, and it finished in just a few minutes (as expected)!  That's when I realized this was the error. I found and fixed my Jinja2 template and now it all works.  I understand this was "my fault", but it does show that there is a syntax-processing and some kind of run-time error in config_system.  Oops.

 

The system was a fresh-install R80.40 (no Jumbo HFA yet; that was coming next in my playbook after the reboot once the products were configured; yes I updated CPDA beforehand, too).

 

I hope this is enough to have someone take a look internally.  Take care!

 

--
Ansible for Check Point APIs series: https://www.youtube.com/@EdgeCaseScenario and Substack
9 Replies
This widget could not be displayed.

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events