External IOC feeds problem after update

[wladw]

Good morning

After update to 81.10.15 we facing problem with external IOC feeds: data fetched successfully, but traffic to a hosts behind the gateway does not get blocked. Before the update everything was fine

Log with fetch info:

Time: 2024-12-10T09:04:21Z
Id Generated By Indexer:false
First: true
Sequencenum: 1
Severity: Informational
Description: External IOC - Fetch succeeded
Type: Control
Blade: Anti-Virus
Origin: GTW-N1
Product Family: Threat
Description: Anti-Virus

Debug:

$FWDIR/bin/ioc_feeder -d -f

cpIsDir: Calling cpIsDirEx: No such file or directory
Using two-stage load
IPS package: Compiled OK.
ERROR: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_IPS_GET was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
fwaccel_dos_ioctl_deny_list_ips_get returned false
ERROR: IOCTL command CPHWD_IOCTL_DOS_GET_NEXT_POLICY_ID was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
ERROR: Failed to get next policy id
ERROR: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_IPS_GET was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
fwaccel_dos_ioctl_deny_list_ips_get returned false
ERROR: IOCTL command CPHWD_IOCTL_DOS_GET_NEXT_POLICY_ID was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
ERROR: Failed to get next policy id
Signatures loaded successfully

Our feed format:

#! DESCRIPTION = TEST,,,,,,
#! REFERENCE = TEST,,,,,,
# Uniq-Name,#Value,#Type,#Confidence,#Severity,#Product,#Comment
8.8.8.8,8.8.8.8,IP,high,high,AB,2024-12-10 13:18:46 CheckPoint WebUI/SSH access from unallowed source

Also, after the update, such logs no longer appear:

[G_W_Albrecht · Accepted solution]

Better step back to R81.10.10 that is the recommended stable version !

[wladw]

The problem was solved after rollback 

[the_rock]

I agree with Chris. I would open TAC case and see if they possible have fix for it. Though @G_W_Albrecht is absolutely right, as per below sk, it does show recommended version at the moment.

https://support.checkpoint.com/results/sk/sk179615

Andy

[Chris_Atkinson]

Please report the issue to TAC for further investigation 

[TJ_Aus]

Confirmed the same on R81.10.15 996003913. Also worked after roll-back to R81.10.10 996002993

2025 Feb 3 11:28:34 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_IPS_GET was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:28:34 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_CLEAR was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:28:34 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_GET_NEXT_POLICY_ID was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:28:34 <hostname> user.info fwaccel: ERROR: fwaccel_dos_get_next_policy_id: Failed to get next policy id
2025 Feb 3 11:35:09 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_IPS_GET was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:35:09 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_CLEAR was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:35:10 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_GET_NEXT_POLICY_ID was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:35:10 <hostname> user.info fwaccel: ERROR: fwaccel_dos_get_next_policy_id: Failed to get next policy id
2025 Feb 3 11:36:01 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_IPS_GET was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:36:01 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_CLEAR was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:36:01 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_GET_NEXT_POLICY_ID was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:36:01 <hostname> user.info fwaccel: ERROR: fwaccel_dos_get_next_policy_id: Failed to get next policy id
2025 Feb 3 11:42:30 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_IPS_GET was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:42:30 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_CLEAR was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:42:30 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_GET_NEXT_POLICY_ID was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:42:30 <hostname> user.info fwaccel: ERROR: fwaccel_dos_get_next_policy_id: Failed to get next policy id
2025 Feb 3 11:43:21 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_IPS_GET was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:43:21 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_DENY_LIST_CLEAR was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:43:21 <hostname> user.info fwaccel: ERROR: fwaccel_dos_ioctl: IOCTL command CPHWD_IOCTL_DOS_GET_NEXT_POLICY_ID was not successful (ioctl.rc = CPHWD_IOCTL_RC_ERROR)
2025 Feb 3 11:43:21 <hostname> user.info fwaccel: ERROR: fwaccel_dos_get_next_policy_id: Failed to get next policy id