[Solved] checkpoint Quantum Spark 1535

[JorisW]

Hi
I tried to add a Quantum Spark 1535 today and got the following response upon discovery:

Error: No recognizable data received from device
Discovery log:
Service check: SSH: Service available
Service connection: SSH: Connection successful
Authentication: SSH: Login successful
Device discovery: Basic device info: discovered
Discovery of available CLI modes: Enable (privilege exec) mode: DEVICE_INTERACTION_ERROR
Disconnect: device disconnected


Doesn't show vendor and type information after this.

[JorisW]

Hi, I had the device discovered now by logging in with ssh and going to expert-mode with command

"expert"

The firewall asked me to set a password for expert-mode. I used that pasword as an enable-password. This got the device discovered.

Now running the backup throws me this error:
INTERACTION_ERROR

[JorisW]

Got backup working by adding this to the config at "C:\Program Files\Unimus\Unimus.l4j.ini"

Code: Select all

-Xms256M
-Xmx768M
-Dunimus.core.connect-timeout=40000
-Dunimus.core.ssh-version-validation-timeout=40000
-Dunimus.core.inter-connection-delay=4000
-Dunimus.core.cli-expect-timeout=40000

I must add that this is a firewall at a remote location.

[Tommy.c]

Hmm...

The timeout having to be so long seems goofy, is the CLI slow on the machine normally?

[JorisW]

The CLI isn't really slow
But when executing the "show configuration" command manually it does pause a few times when outputting the response.
Not a "-more-" response, but a blinking cursor.

[JorisW]

Suddenly stopped working with message: "INTERACTION_ERROR"

The device debug log does show my config.

Does anyone have an idea?

[Tommy.c]

Is the entirety of your configuration showing up in the logs?

I suspect there might be other timeouts we may need to adjust for that Spark 1535
https://wiki.unimus.net/display/UNPUB/C ... t+timeouts

[JorisW]

This is currently my config, but still no luck yet
Added a Checkpoint Quantum Spark 1575 too that has the same issue.

Code: Select all

-Xms256M
-Xmx768M
-Dunimus.core.connect-timeout=40000
-Dunimus.core.ssh-version-validation-timeout=40000
-Dunimus.core.inter-connection-delay=40000
-Dunimus.core.cli-expect-timeout=40000

These are the last lines of the device output log:

Code: Select all

set vpn site-to-site advanced-settings is-static-misp-role "false"
set vpn site-to-site advanced-settings life-sign-transmitter-interval "10"
set vpn site-to-site advanced-settings log-vpn-packet-handling-errors "log"
set vpn site-to-site advanced-settings delete-ike-sas-from-a-dead-peer "true"
set vpn site-to-site advanced-settings vpn-tunnel-sharing "subnets"
set vpn site-to-site advanced-settings limit-open-sas "20"
set vpn site-to-site advanced-settings maximum-concurrent-vpn-tunnels "10000"
set vpn site-to-site advanced-settings vpn-down-summary-interval "1_Hour"
set vpn site-to-site advanced-settings period-after-crl-not-valid "1800"
set vpn site-to-site advanced-settings copy-diff-serv-to-ipsec-packet "true"
set vpn site-to-site advanced-settings keep-dont-fragment-flag-on-packet "false"
set vpn site-to-site advanced-settings delete-ipsec-sas-on-ikes-delete "false"
# A list of all the available updatable objects which can be selected

DEVICE OUTPUT END:

actual last lines of "show configuration" is:

Code: Select all

set vpn site-to-site advanced-settings maximum-concurrent-vpn-tunnels "10000"
set vpn site-to-site advanced-settings vpn-down-summary-interval "1_Hour"
set vpn site-to-site advanced-settings period-after-crl-not-valid "1800"
set vpn site-to-site advanced-settings copy-diff-serv-to-ipsec-packet "true"
set vpn site-to-site advanced-settings keep-dont-fragment-flag-on-packet "false"
set vpn site-to-site advanced-settings delete-ipsec-sas-on-ikes-delete "false"
# A list of all the available updatable objects which can be selected
# The results of a scan for available wireless networks to connect to
# Wireless statistics
# Wireless statistics per vap
firewall> 

[Tommy.c]

It looks like Unimus is getting confused by the lack of a further prompt from the device.

have you tried using the $(wait-echo no) modifier? https://wiki.unimus.net/display/UNPUB/M ... OR%22group