Anti-spam and email security blade always bypassing all emails

[Baasanjargal_Ts]

Non spam bypassedd (Temporary scan failure)

From the logs Anti-spam and email security blade always bypassing all emails

IT seems Anti spam and email security blade is not working well.

[PhoneBoy]

Recommend getting the TAC involved in this.

[Baasanjargal_Ts]

Ok, Created SR.
Thank you.

[Nick_Doropoulos]

Hello,

To be able to assist you fully, could you please provide us with the output of the following commands:

- fw ver

- enabled_blades

- cpwd_admin list

Moreover, could you answer the following questions:

1) Do you use a proxy in your environment?

2) Do you have a proxy configured on the Anti-Spam blade?

3) Did the Anti-Spam blade ever work for you? If so, do we have a time stamp of when the issue was first reported?

4) Has your gateway been configured as an MTA agent?

Thanks.

[Baasanjargal_Ts]

[Expert@gw-cp:0]# fw ver
This is Check Point's software version R80.10 - Build 190

[Expert@gw-cp:0]# enabled_blades
fw vpn urlf av aspm appi ips dlp identityServer anti_bot ThreatEmulation qos mon vpn

[Expert@gw-cp:0]# cpwd_admin list
APP PID STAT #START START_TIME MON COMMAND
CPVIEWD 5207 E 1 [14:40:22] 11/11/2019 N cpviewd
HISTORYD 5210 E 1 [14:40:27] 11/11/2019 N cpview_historyd
CPD 5222 E 1 [14:40:28] 11/11/2019 Y cpd
MPDAEMON 5260 E 1 [14:40:30] 11/11/2019 N mpdaemon /opt/CPshrd -R80/log/mpdaemon.elg /opt/CPshrd-R80/conf/mpdaemon.conf
CI_CLEANUP 5451 E 1 [14:40:44] 11/11/2019 N avi_del_tmp_files
CIHS 5453 E 1 [14:40:44] 11/11/2019 N ci_http_server -j -f /opt/CPsuite-R80/fw1/conf/cihs.conf
FWD 29756 E 1 [18:08:21] 12/11/2019 N fwd
FWM 5468 E 1 [14:40:44] 11/11/2019 N fwm
CPM 5798 E 1 [14:40:46] 11/11/2019 N /opt/CPsuite-R80/fw1 /scripts/cpm.sh -s
LPD 6040 E 1 [14:40:59] 11/11/2019 N lpd
RAD 6433 E 1 [14:41:04] 11/11/2019 N rad
DLPU_0 30321 E 1 [18:08:29] 12/11/2019 Y dlpu -i4 0 0 -i6 -1 -1
DLPU_1 30327 E 1 [18:08:29] 12/11/2019 Y dlpu -i4 1 1 -i6 -1 -1
DLPU_2 30338 E 1 [18:08:30] 12/11/2019 Y dlpu -i4 2 2 -i6 -1 -1
DLP_WS 20898 E 1 [14:43:37] 11/11/2019 Y cserver
FGD50 4255 E 1 [14:45:15] 11/11/2019 N fgd50
RTMD 6219 E 1 [14:45:37] 11/11/2019 N rtmd
SOLR 6309 E 1 [14:45:35] 11/11/2019 N java_solr /opt/CPrt- R80/conf/jetty.xml
RFL 6338 E 1 [14:45:35] 11/11/2019 N LogCore
SMARTVIEW 6353 E 1 [14:45:35] 11/11/2019 N SmartView
INDEXER 6495 E 1 [14:45:35] 11/11/2019 N /opt/CPrt-R80/log_in dexer/log_indexer
SMARTLOG_SERVER 6538 E 1 [14:45:36] 11/11/2019 N /opt/CPSmartLog -R80/smartlog_server
EXPORTER.logrhythm 6628 E 1 [14:45:43] 11/11/2019 N /opt/CPrt-R8 0/log_exporter/targets/logrhythm/log_exporter -export /opt/CPrt-R80/log_exporter /targets/logrhythm/targetConfiguration.xml
CPSEMD 17276 E 1 [14:51:55] 11/11/2019 Y cpsemd
CPSEAD 6832 E 1 [14:45:45] 11/11/2019 N cpsead
DASERVICE 6887 E 1 [14:45:47] 11/11/2019 N DAService_script
CPSM 22837 E 1 [14:52:41] 11/11/2019 N cpstat_monitor

-------------------------------------------------------------

1. No proxy

2. No proxy

3. It didn't work well before.

4. Not configured.

[Baasanjargal_Ts]

Is there anyone who can now about this issue.?

[Nick_Doropoulos]

Hello,

Before suggesting any troubleshooting steps may I ask what was the outcome of the SR you raised with the TAC?

Thanks.

[Baasanjargal_Ts]

TAC Collected debug files and analyzed them. But it doesn't resolve yet.