Sandblast Browser Agent return Unexpected Server from server

[Arun_R]

Hi Team,

I am facing an issue in Sandblast Agent for Browser, Whenever my client is trying to download the files from the website. Browser Agent returns an error.

I.e: Original File Downloaded. Error: Server returns an unexpected response(Forbidden).

When I tried to download checkpoint articles(ex: Admin guides) it returns the same error.

If there anything I need to do on my Endpoint Management Server to resolve this rather then creating exception rule.

Note: Clients Endpoint Managment Server has sandblast license.

-Arun.R

[Jesús_Toledano]

Hi Arun,

This error is probably related to a license issue. 

Have you checked that everything is right under SmartEndpoint > Reporting > License Report > Sandblast Agent TX and TE ?

Jesús

[Arun_R]

Hi Jesus,

Sorry for the delay.

Yes, I checked the license part under License Report tab which is fine.

Event its happens the same whenever I build endpoint lab.

- Arun.R

[Jesús_Toledano]

Hi Arun,

In that case please follow this guide I just translated from the Spanish for you:

https://community.checkpoint.com/docs/DOC-2828-endpoint-management-deployment-v15 

Cheers!

[Arun_R]

Dear Jesus,

Thanks for your wonderful article which will be helpful for all of us.

I am still wondering why we are getting a warning message while downloading any pdf, word etc files in SBA browser Agent.

I.e: Original File Downloaded. Error: Server returns an unexpected response(Forbidden).

Here I attached the screenshot, Pls help me to understand this issue and to solve this.

And I am really appreciated your's effect to change the article from Spanish to English. Once again Thank you for that.

- Arun.R

[PhoneBoy]

As pointed out previously, the reason you'd see it is a license issue.

I would check with Account Services to see that you, in fact, have the correct licenses.

[Arun_R]

Dear Dameon,

Thanks for the update.

Sorry for asking this once again, do we facing this issues on trial license, b'cause I faced the same issue on my lab too.

- Arun.R

[Jesús_Toledano]

Hi Arun, please follow the guide to deploy the trial license, I did it several times without any issue.

Also please, check if there is any error within this log files:

C:\ProgramData\CheckPoint\Logs\TE.log

C:\Program Files (x86)\CheckPoint\Endpoint Security\Endpoint Common\Logs\cpda.log

If you still are having the same issue, please open a ticket with the support and they'll go deeper.

HTH,

Jesús

[Arun_R]

Dear Jesus,

Thanks for the assist.

I will perform as per the guide, If still face the issue. I will raise SR.

- Arun.R

[Thomas_Werner]

Is the Browser Plugin configured for cloud usage or local SandBlast appliance ?

Regards Thomas

[Arun_R]

Dear Thomas,

I apologize for the delay, due to some medical emergency I could not able to follow up this checkmate.

Coming to question is Endpoint Sandblast is configured on VM.

Regards,

ArunHari.R

[Victor_MR]

Hi Arun,

Did you finally solve this?

I think the question from Thomas (above) is very relevant. I've seen this before due to a certificate error while using local appliance (and the certificate is not correctly deployed). If you're using only Sandblast in cloud, then the issue should be different (also probably related to the license).

[Arun_R]

Hi Victor,

This issue is still not solved.

Even I think this might an issue with certificate level, But Sandblast Agent is installed as a browser extension isn't so I am not checked further and more due to some medical reason I do not frequently touch base with my client.

- Arun.R

[Victor_MR]

Just in case your customer is using a Sandblast appliance, please check the sk113599 (if you haven't done yet), specially at the portal certificate section.

SandBlast Agent for Browsers - working with Security Gateway or SandBlast Threat Emulation appliance 

Get well!

[Arun_R]

Dear Victor,

My client has implemented the Endpoint Sandblast server in VM. Will this SK applicable if its VM?

- Arun.R

[Victor_MR]

I understand you're referring to the Endpoint Management Server. The thing is if they're using a Sandblast appliance or the Check Point Cloud for Threat Emulation and Threat Extraction. Having the Management Server in VM or appliance would not affect in this case

Regards!

[Arun_R]

No they are not using any Sandblast Appliance or any checkpoint cloud for emulation and extraction.

Client is using VMware to build and manage the Endpoint Server(which includes the Sandblast Blades).

- Arun.R

[Thomas_Werner]

Ok so I´ll summarize:

You are using SandBlast Agent with the Browser plugin and an EPM on VM.

If you are not using a SandBlast Appliance the SBA browser plugin will send it´s request to Check Point´s cloud service.

A few questions on this topic:

1) License

   on the client with SBA if you goto chrome://policy in Google Chrome browser do you see a "te_cloud_api_key" with an appropriate entry related to your EPM license CK ?

2) Do you use any proxies (especially authenticating proxies) between the client and the internet

Regards Thomas

[Arun_R]

Dear Thomas,

Thanks for the assist.

Seem to be bit understanding now. I will check with my client.

Regards,

 Arun.R