Recently issue encountered such as:
- Customer running R77.20 Gaia
- Standby member showing expired contract status
- Multiple steps such as remove cache, upgrade smart console to support SHA-256 and remove contract does not resolve the issue
- Remove and reinsert contract does not solve as well
The solution is to change the this file to 1 – vi $FWDIR/appi/update/next_update
Wait for it to update to Checkpoint cloud and it will show correct date.
Otherwise there is another alternative if above does not work.
First step:
Disable automatic updates for Application Control / URL Filtering / Anti-Bot / Anti-Virus:
Connect with SmartDashboard to Security Management Server / Domain Management Server.
Go to the Application & URL Filtering tab.
Expand Advanced in the left pane.
Click on Updates.
In the Automatic Application Updates section, uncheck both boxes:
Second step:
[Expert@MGMT]# rm $FWDIR/av/ca/update/incoming/*
[Expert@MGMT]# rm $FWDIR/uf/sc/update/incoming/*
Manually download the contracts file from User Center:
Important Note: On the Multi-Domain Security Management Server, first switch to the context of the involved Domain Management Server with mdsenv <Domain_Name> command.
[Expert@MGMT]# $CPDIR/bin/contract_util download uc upgrade UserName Password [Proxy_IP_Address [Proxy_UserName:Proxy_Password]]
Restart Check Point services:
On the Security Management Server:
[Expert@MGMT]# cpstop
[Expert@MGMT]# cpstart
Third step:
Verify the subscription status on the Security Gateway / each Cluster member:
For Application Control:
[Expert@GW]# cpstat appi -f subscription_status
Subscription status: valid
Subscription expiration date: Sat Dec 15 00:00:00 2018
Subscription description: Contract is up to date.
For URL Filtering:
[Expert@GW]# cpstat urlf -f subscription_status
Subscription status: valid
Subscription expiration date: Sat Dec 15 00:00:00 2018
Subscription description: Contract is up to date.
Last step:
Enable automatic updates for Application Control / URL Filtering / Anti-Bot / Anti-Virus:
Connect with SmartDashboard to the Security Management Server / Domain Management Server.
Go to the Application & URL Filtering tab.
Expand Advanced in the left pane.
Click on Updates.
In the Automatic Application Updates section, check both boxes.
Go to the Threat Prevention tab (in R77 and lower, this tab is called Anti-Bot & Anti-Virus).
Expand Advanced in the left pane.
Click on Updates.
In the Automatic Updates section, check all boxes.
Save the changes: go to File menu – click on Save.
Install the policy onto the relevant Security Gateway / Cluster object
Cheers
engineereverydaylife 