SmartConsole potential CPM issues

[Tom_Cripps]

Hi there,

Has anyone had a run in with this before? See attached image.

We're running the latest SmartConsole, and with one of the latest HotFixs - 169. We have tried to re-establish SIC but that hasn't fixed anything.

Any ideas would be great!!

Tom

[Mark_Mitchell]

Hi Tom, 

Could you run the below command and advise on the output?

$MDS_FWDIR/scripts/cpm_status.sh

Then if you run the following and advise on the output. 

$MDS_FWDIR/scripts/server_status.sh

These 2 commands are essentially just checking to see if the server is up and running correctly. Take a look at "An error occurred while receiving the HTTP response to..." error when trying to log into R80.10 Sma...  specifically the troubleshooting steps in the symptoms section. 

Feel free to post the outputs of the tcpdump, netstat and log file entries from SOLR file.

If this is a production SMS, it may be an idea to raise a TAC case as that may be quicker to get a resolution. 

Regards

Mark

[Tom_Cripps]

Hi Mark,

CPM is up an running. I have already spotted that SK and it is nothing related to us. We're using version higher than those which say it has been fixed. 

We're on take 105 for SmartConsole and 169 for the Management

Tom

[Mark_Mitchell]

Hi Tom, 

Has anything else happened up until this point? Upgrade from previous version etc? I.e the events leading up to this issue? Is this a production system?

I would proceed in debugging the CPD process using the following. 

R80.x Security Management server main processes debugging 

Regards

Mark

[Tom_Cripps]

Hi,

Nothing has happened that I am aware of. 

We're also seeing certificates being revoked too which aren't so there could be an issue with the ICA server too maybe. 

I will proceed with the debugging this afternoon. 

Thank you for the information

Tom

[Mark_Mitchell]

Hi Tom, 

My next thought was going to be the SMS ICA. It may need the ICA resetting. But I would recommend raising it with Check Point TAC as depending on the size of your environment may be quote involved. 

Regards

Mark

[Tom_Cripps]

In terms of resetting back to factory default?

Thanks,

Tom

[Mark_Mitchell]

The ICA could be reset from within Gaia on the management server. However if this is a production system. I would seek further help from TAC. 

Regards

Mark

[Tom_Cripps]

Of course!

I will keep in mind if we don't get anything from our current open case.

Thanks,

Tom

[Mark_Mitchell]

Ah, I didn't realise you had a TAC case open already. 

Hope you get it sorted. Would be good to know what the issue/cause is if you get to find out. 

Regards

Mark

[Tom_Cripps]

Yeah but had nothing great from it yet. 

Will keep this idea in mind like I said, it does seem viable.

Thanks,

Tom

[Tom_Cripps]

Hi Mark,

We have now resolved this, we just completed this by using this SK to revoke and re make our SIC certificate 
Creating a new SIC certificate

Thanks,

Tom

[Mark_Mitchell]

Hi Tom,

Good to hear. Thanks for sharing the resolution. And much less drastic as resetting the ICA.

Regards

Mark 

[Tom_Cripps]

Loads better!

I can't say if this will fix all of these issues but loads better than resetting ICA