AnsweredAssumed Answered

IPS Update problem after upgrading to R80.10

Question asked by Alejandro Lansac on Jul 26, 2018
Latest reply on Jul 30, 2018 by Alejandro Lansac

Like • Show 2 Likes2
Comment • 5

This week I have successfully upgraded our Management Server from R77.30 to R80.10. Gateways are still in R77.30. Everything works fine, but when I try to update the IPS package I receive the error “IPS Update Failed”. I have the same error message updating using the Smart Console or the security management server. It seems that it downloads the update successfully but it fails on the installation.

The Log File $FWDIR/log/cpm.elg show the following errors

26/07/18 10:58:56,042 ERROR internal.operation.OperationSvcImpl [qtp335532636-92]: caught exception "null" from class java.lang.NullPointerException

26/07/18 10:58:56,042 ERROR coresvc.internal.FwmSvcImpl [qtp335532636-92]: Error updating 96 object(s) from set.

26/07/18 10:58:56,042 ERROR internal.operation.OperationSvcImpl [qtp335532636-92]: caught exception "null" from class java.lang.NullPointerException

26/07/18 10:58:56,043 ERROR infrastructure.logging.DefaultExceptionLoggerHandlerImpl [qtp335532636-92]: incident [109177d7-0ec9-4655-886c-922359bbe9c6]:

26/07/18 10:58:56,043 ERROR dleserver.internal.DefaultExceptionMapper [qtp335532636-92]: Internal runtime error

Hat anybody experienced similar Problems?

No one else has this question

Outcomes

Dan Sommerman

Jul 26, 2018 6:43 AM

Hi Alejandro, I just saw this with another customer. You may need to follow the steps below to update the licenses:

To download the Service Contract File:

Log into https://usercenter.checkpoint.com/usercenter/index.jsp.
Click "Assets/Info".
Click "Download Contract File" under "Tools" option.
In the section titled "Service Contract File Download", select the Account(s) you need your Service Contract File for.
Select "Email File" or "Download Now".

To install the Service Contract File via SmartUpdate:

Log into SmartUpdate
From the menu , select "Licenses & Contracts", select 'Update Contract > Import File'
Browse to the directory where the file is located and click 'Open'
The file will be added to the respective certificate key(s)
To verify the file has been installed properly, run 'cplic print' on the Security Gateway, and you should now see the contract information.

For additional information and assistance with downloading and installing your Service Contract File, please refer to SecureKnowledge document sk33089, "What is a Service Contract File?".

If you are unable to install the Service Contract File using SmartUpdate or it has not been installed properly, two additional methods may be used to install the file:

If running in a distributed environment (gateway/management server are installed different servers), run the following command in Expert mode on the Security Gateway (firewall): contract_util mgmt

Save the file locally on the Security Gateway (firewall) and run the following command:

cplic contract put -o <filename>.xml

Finally, verify if the file was successfully installed, run 'cplic print' on the command line.

Actions

Tomer Sole

Jul 26, 2018 11:33 PM

Hi Alejandro,

We want to prevent this from happening,

To do that, we would need you to open a service request: Check Point User Center - Customer Portal for Licensing, Support and Account Management

Opening a service request is also available directly from SmartConsole whenever a problem occurs: Cool Feature: Open a Service Request from SmartConsole

And this way, we will be able to release a Jumbo Hotfix which in case of IPS Update failure due to expired contract, the app will say - "please renew your contract".

Let me know if you have any question regarding the support request process.

Actions

Alejandro Lansac @ Tomer Sole on Jul 27, 2018 1:28 AM

Hi Dan and Tomer and thanks for your answers, but by now I have not reinstalled the service contracts.

I have opened a service request and the support team has provided me the Hotfix “fw1_wrapper_HOTFIX_R80_10_HF_228_GA_FULL.tgz”. After the patch installation IPS Update works fine, I can see the new protections in Smart Console and the policy install on gateways works fine. Everything seems correct, but I still have a large list of errors in the cpm.elg during IPS Upgrade. The support is still working to fix this behavior.

Actions

Tomer Sole

@ Alejandro Lansac on Jul 27, 2018 7:24 AM

Something about "many errors in cpm.elg" - we get them with normal use as well. Please do not have those as indicators to problems alone. Many of them are false-positive. If something isn't working and the direct error message that you see on the screen is not clear enough, cpm.elg will not necessarily help you. It is better to contact support and send them the files that they need. Please believe we are all about self-help tools but at this point cpm.elg is not a good helper.

Actions

Alejandro Lansac @ Tomer Sole on Jul 30, 2018 12:49 AM

That was also the answer from the support Team. The Management Server works without Problems, we close the ticket, and today we will upgrade 2 gateways.

Actions

5 Replies

Dan Sommerman Jul 26, 2018 6:43 AM
Mark Correct
Correct Answer
Hi Alejandro, I just saw this with another customer. You may need to follow the steps below to update the licenses:

To download the Service Contract File:
1. Log into https://usercenter.checkpoint.com/usercenter/index.jsp.
2. Click "Assets/Info".
3. Click "Download Contract File" under "Tools" option.
4. In the section titled "Service Contract File Download", select the Account(s) you need your Service Contract File for.
5. Select "Email File" or "Download Now".
To install the Service Contract File via SmartUpdate:
1. Log into SmartUpdate
2. From the menu , select "Licenses & Contracts", select 'Update Contract > Import File'
3. Browse to the directory where the file is located and click 'Open'
4. The file will be added to the respective certificate key(s)
5. To verify the file has been installed properly, run 'cplic print' on the Security Gateway, and you should now see the contract information.
For additional information and assistance with downloading and installing your Service Contract File, please refer to SecureKnowledge document sk33089, "What is a Service Contract File?".

If you are unable to install the Service Contract File using SmartUpdate or it has not been installed properly, two additional methods may be used to install the file:
1. If running in a distributed environment (gateway/management server are installed different servers), run the following command in Expert mode on the Security Gateway (firewall): contract_util mgmt
Or
1. Save the file locally on the Security Gateway (firewall) and run the following command:
cplic contract put -o <filename>.xml

Finally, verify if the file was successfully installed, run 'cplic print' on the command line.
Like • Show 2 Likes2
Actions
Tomer Sole Jul 26, 2018 11:33 PM
Mark Correct
Correct Answer
Hi Alejandro,

We want to prevent this from happening,

To do that, we would need you to open a service request: Check Point User Center - Customer Portal for Licensing, Support and Account Management
Opening a service request is also available directly from SmartConsole whenever a problem occurs: Cool Feature: Open a Service Request from SmartConsole

And this way, we will be able to release a Jumbo Hotfix which in case of IPS Update failure due to expired contract, the app will say - "please renew your contract".

Let me know if you have any question regarding the support request process.
Like • Show 0 Likes0
Actions
- Alejandro Lansac @ Tomer Sole on Jul 27, 2018 1:28 AM
  Mark Correct
  Correct Answer
  Hi Dan and Tomer and thanks for your answers, but by now I have not reinstalled the service contracts.
  I have opened a service request and the support team has provided me the Hotfix “fw1_wrapper_HOTFIX_R80_10_HF_228_GA_FULL.tgz”. After the patch installation IPS Update works fine, I can see the new protections in Smart Console and the policy install on gateways works fine. Everything seems correct, but I still have a large list of errors in the cpm.elg during IPS Upgrade. The support is still working to fix this behavior.
  Like • Show 0 Likes0
  Actions
  - Tomer Sole @ Alejandro Lansac on Jul 27, 2018 7:24 AM
    Mark Correct
    Correct Answer
    Something about "many errors in cpm.elg" - we get them with normal use as well. Please do not have those as indicators to problems alone. Many of them are false-positive. If something isn't working and the direct error message that you see on the screen is not clear enough, cpm.elg will not necessarily help you. It is better to contact support and send them the files that they need. Please believe we are all about self-help tools but at this point cpm.elg is not a good helper.
    Like • Show 1 Like1
    Actions
    - Alejandro Lansac @ Tomer Sole on Jul 30, 2018 12:49 AM
      Mark Correct
      Correct Answer
      That was also the answer from the support Team. The Management Server works without Problems, we close the ticket, and today we will upgrade 2 gateways.
      Like • Show 2 Likes2
      Actions

IPS Update problem after upgrading to R80.10

Outcomes

Related Content

Recommended Content