topic Re: syslog generated during policy install in Firewall and Security Management

syslog generated during policy install

checkma_a — Tue, 03 Aug 2021 09:07:08 GMT

Hi all 🙂

When the policy is installed in GW, the following message is generated in GW /var/log/messages.

kernel: [fw4_0];[ERROR]: up_fw_load_taditional_vpn_inspect_func_ids: failed to get inspect function CLIENT_ENCRYPT_SCV_W_SRVC_FUNC id0 x0a
kernel: [fw4_0];[ERROR]: up_fw_load_taditional_vpn_inspect_func_ids: failed to get inspect function IPPOOLS_ENCRYPT_WITH_SRVC_FUNC id0 x0a
kernel: [fw4_0];[ERROR]: up_fw_load_taditional_vpn_inspect_func_ids: failed to get inspect function ENCRYPT_WITH_SERVICE_FUNC id0x0a
kernel: [fw4_0];[ERROR]: up_fw_load_taditional_vpn_inspect_func_ids: failed to get inspect function RECORD_CONN_WITH_SCV_FUNC id0x0a
kernel: [fw4_0];[ERROR]: up_fw_load_taditional_vpn_inspect_func_ids: failed to get inspect function CLIENT_ENCRYPT_FUNC id0x0a
kernel: [fw4_0];[ERROR]: up_fw_load_taditional_vpn_inspect_func_ids: failed to get inspect function ENCRYPTION_FUNC id0x0a
kernel: [fw4_0];[ERROR]: up_fw_load_taditional_vpn_inspect_func_ids: failed to get inspect function IPPOOLS_ENCRYPTION_FUNC id0x0a

If you look at the above message, it looks like it is related to VPN, but

My customer is using GW blades only as 'Firewall'.

Do not use 'IPSec VPN' blades.

Has anyone seen messages like the above or know why they are generated?

Thank You.

Re: syslog generated during policy install

PhoneBoy — Thu, 05 Aug 2021 14:53:51 GMT

These are related to Remote Access, I believe.
I assume you are also not using Mobile Access blade?
I see you've already opened a TAC case, which is what I would have suggested next.

Re: syslog generated during policy install

checkma_a — Fri, 06 Aug 2021 03:36:55 GMT

As I wrote above, the blade is only using 'FireWall'.
As you said, I open a case to TAC and wait for an answer.

Re: syslog generated during policy install

Ilya_Yusupov — Sun, 08 Aug 2021 08:05:36 GMT

Hi @checkma_a ,

can you please share what in which version you saw it?

Thanks,

Ilya

Re: syslog generated during policy install

Timothy_Hall — Sun, 08 Aug 2021 13:48:33 GMT

Looks to me like your policy package is set to use VPN "Traditional Mode" instead of the newer "Simplified Mode" introduced in R52 (even though the syslog messages have a typo in them). Under Manage Policies & Layers do you have this checkbox set:

Also check this Global Properties screen:

Re: syslog generated during policy install

checkma_a — Mon, 09 Aug 2021 05:01:11 GMT

The OS version is R80.40, and the hotfix take is 94.

Re: syslog generated during policy install

checkma_a — Mon, 09 Aug 2021 05:03:25 GMT

Timothy_Hall As you say

It is set to Traditional mode.

Re: syslog generated during policy install

PhoneBoy — Mon, 09 Aug 2021 05:19:31 GMT

If you're certain this policy does not contain any VPN rules (with action Encrypt) then you can change the policy to Simplified Mode using the procedure in: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk171035&partition=Expert&product=SmartConsole

That said, the time to convert to Simplified Mode is long overdue.
Simplified mode was introduced in NG FP2 (aka R52) and was formally deprecated in R8x.
I assume we will remove support for this feature entirely in an upcoming version.

Re: syslog generated during policy install

checkma_a — Tue, 10 Aug 2021 08:09:03 GMT

Thanks to everyone who posted replies.

After activating vpn traditonal mode, I tested in my lab whether symptoms replicated, but the symptoms were not replicated.

I think you should check the TAC answer as well.

thanks.