topic Re: rulebase internal error in Firewall and Security Management

rulebase internal error

Louised — Tue, 25 Jul 2023 02:59:22 GMT

Hello everybody
Some people have reported that they cannot access the internet. There are many alert logs in the firewall logs, which indicate rulebase internal error。View/var/log/message to display fhandle_ Pool_ Add: Table kbufs - All available pools exhausted, FW-1: fwx_ Create_ Xlbuf: error allocating kbuf, FW-1: fwx_ Get_ Xlation: fwxl is NULL.I unable to install policy either.
When I restart the firewall, it returns to normal.What caused this and how I can avoid it next time.
Checkpoint SMC is R81.20,Gateway is 4600,R80.40 TAKE 180.
Check the /var/log/message

Re: rulebase internal error

_Val_ — Tue, 25 Jul 2023 10:32:42 GMT

If looks like a performance issue that might be address by some tuning. Look into sk149254 for more details and references.

Re: rulebase internal error

Louised — Tue, 25 Jul 2023 10:42:44 GMT

We noticed that both CPU and memory are very sufficient.It looks like some table is full.

Re: rulebase internal error

Chris_Atkinson — Tue, 25 Jul 2023 11:06:15 GMT

Suggest upgrading the JHF to a more recent recommended one.

What is the current memory population of this appliance?

(Note 4600 are End of support and you should consider upgrading).

Re: rulebase internal error

Louised — Tue, 25 Jul 2023 11:23:46 GMT

The memory of the appliance is currently 8GB, and we are planning to upgrade the new hardware by the end of the year. Can you help us determine what caused it? There are about 300 computers connected to the internet there.

Re: rulebase internal error

CheckPointerXL — Mon, 31 Jul 2023 09:04:21 GMT

Take 110

Released on 30 July 2023

PRJ-46113,
PRHF-28489

Security Gateway

In rare scenarios, the Security Gateway may drop the traffic after "Rulebase Internal Error" which occurs during policy installation.

Re: rulebase internal error

Alexander_Wilke — Thu, 20 Feb 2025 08:06:04 GMT

Hello,

I know this is an old issue. However it is still present in R81.10 Jumbo HFA Take 150 in february 2025.
We had this issue in the past and TAC could not find the root cause.

we had it on a 64k and "asg_policy verify -v" should correct policy - however an immediate additional policy Install after the error occured only on 1 of 5 SGMs the issue was solved. And it started immediately after the first Policy Install.

So I suspect a Policy Install mechanism error and to solve it another Policy Install helps.
However this leads to business impact and tells me that this issue is not solved since 2019 undtil 2025.

Traffic dropped with message information: "Rulebas... - Check Point CheckMates