Loss of HTTPS and SSH access to ClusterXL members, help?

[Vladimir]

After three days of building client's CXL with SMS on 5400s and Smart-1 410, suddenly could not connect to either WebUIs or SSH into the gateways. Since I've been working all day on crafting the AppC/URLF layer, I did not notice when this become an issue.

Smartlog showing events that sounds like "connection dropped by multiportal infrastructure" or some such.

In "Rules Matched" I am seeing two accepts, one from Access Control Policy and one from AppC/URLF.

The only blades enabled on cluster are Firewall, IPSEC, AV/AB/IPS/Monitoring/URLF/AppC.

So I do not expect the 443 being shared with anything else.

For giggles, tried changing portal to listen on 10443, sk115732, but no dice.

Management laptop, SMS and Mgmt interfaces of the gateways are on the same subnet and switch.

No policy installation / SIC issues.

Has anyone seen this before and are willing to share the remedies?

Thank you,

Vladimir

[Danny]

I had a similar issue last year when I stopped cpsizeme via Ctrl-C which caused the /var/tmp folder to be removed. Once I logged out I could never log back in to the system via ssh, console nor WebUI. I had to start from a Linux LiveCD, mount the partitions and recreate the /var/tmp folder manually.

[Vladimir]

Wow! Was it on a physical appliance or VM?

I am a bit doubtful that this is same case as it is happening on both cluster members and I was not running and interrupting any processes on those.

That being said, I'll connect via RS232 (serial console access is working), and take a look at the /var/tmp.

Thank you for the suggestion. 

[Vladimir · Accepted solution]

The mystery is partially solved: The Implicit Cleanup Rule in App Control and URLF layer set to "Drop" was causing the issue.

Surprisingly, it was not obvious in case of WebUI: Matched Rules were showing both, the Network and the App Control accepting traffic, yet connectivity was failing.

Thankfully, SSH attempts showed that Implicit Cleanup in App Control was dropping it, which led me to look in to either changing Implicit rule to Accept or adding Explicit rule on top of the policy for management traffic.

I am a little peeved, that the management traffic to infrastructure components is not exempt from App Control.

[PhoneBoy]

I think most of the Check Point management traffic is (assuming you have implicit rules enabled) 

SSH and WebUI access isn't included as part of this and must be explicitly allowed.

[Vladimir]

I guess CP was not kidding about "Small Office Appliances" in the Global Properties:)

[PhoneBoy]

I wasn't even aware that was a Global Property

[Tomer_Sole]

Compliance Blade has a validation for that.

[Vladimir]

Well, I would still like for someone at CP to take a look at the WebUI portion of it. As was mentioned in the original post, "in case of WebUI: Matched Rules were showing both, the Network and the App Control accepting traffic, yet connectivity was failing"