Upgrade of Mgmt Server to 81.10 broke Threat Prevention

[Oliver_Matt]

Hello Community,

we've upgraded our management server to version R81.10 while our gateways are still on R80.40 with the latest jumbo hotfix. As soon as the policy (access & threat prevention) was installed the first time via the updated server our complete threat prevention rule set went out of service.

We are only able to see logs which are created by the 39 Core Protections. No more logs are shown for IPS, Anti-Bot, Anti Virus.

By checking one of the logs from a core protection we saw that the name of our threat profile changed from our usual name to "No_protection_1b58..."

When I click on the "No_protection_1b58..." threat profile I get forwarded to our currently active threat prevention profile.

We've tried almost anything:

Creating new threat profiles and add them to our threat prevention custom policy
Creating new profiles for the 39 core protections and inspection settings
Creating new threat prevention layers

None off this worked out. Beside of the 39 core protections threat prevention is not showing any logs anymore and we are pretty sure that it's currently not working.

What do we miss? Any help would be highly appreciated.

Kind regards

Oliver

[_Val_]

Pleas raise a TAC case for this

[the_rock]

@_Val_ is right, this warrants TAC case for sure. In the meantime, cant say I ever seen this myself personally, but, can you verify that nothing changed as far as threat prevention policy? Does it look same as before?

Andy

[Oliver_Matt]

@_Val_, @the_rock  - Thx for your quick response. We've double checked it a few time. Nothing has change on the threat prevention policy - looks exactly the same as before. We'll get in touch with TAC.

Oliver

[the_rock]

Something I would try...see if you can uninstall threat prevention policy and then install it again, or, not sure what blades are on, but maybe disable them, push policy and then re-check same blades, install policy. Are threat prevention profiles still intact?

Andy

[Timothy_Hall]

It appears that when the log is generated by the firewall it is not correctly identifying the matching TP policy profile, what does fw stat -b AMW show when run on the firewall?  If it shows a loaded TP policy, TP is probably still working and this looks like a cosmetic log issue to me.

Verifying that TP is still working as expected is very important when tweaking and tuning the TP config, here is an excerpt from my IPS/AV/ABOT Immersion series discussing this topic that should allow you to verify TP is still working as expected:

[Oliver_Matt]

Hello Timothy,

thank you for your input - it appears that your command shows that our TP profile is loaded. We've already opened a TAC case with CP. Let's hop that it's only a cosmetic issue.

Oliver

[Shiran_Gold]

Hey Oliver,

Was a TAC SR raised?

please check your inbox, I sent you a private message
I would like to follow up with you on that issue

[Oliver_Matt]

Hello Shiran,

I've sent you an email.

Kind regards

Oliver

[the_rock]

Please let us know how this gets resolved. Thanks very much!

Andy

[Oliver_Matt]

Hi all,

we got told that it is only a cosmetic bug. IPS / TP is running and enforcing protections but we are not able to see the according logs. There will be a hotfix for this in the next Jumbo Hotfix which has no ETA as of now.

Well - who cares about logs? 🤔

We will upgrade our gateways to R81.10 soon and hope that this might get our logs back. Otherwise we have to wait for the next JHF.

Oliver 

[Oliver_Matt · Accepted solution]

Solved: We've updated our Gateways to Version R81.10. IPS & TP Logs are displayed again.