topic Re: Unexpected Reboots in Firewall and Security Management

Unexpected Reboots

Matlu — Wed, 26 Mar 2025 17:45:01 GMT

Hello, Mates.

I have a CP model 23800 box.
This device is part of a VSX Cluster, but since some months ago, this box is experiencing recurrent “reboot” problems, from one moment to another, it restarts without any reason, or in other extreme cases, the equipment crashes and after a couple of hours it gets up, without intervention from our side.

The case is escalated with the TAC, but they still can't find a reason for this event.

In this scenario, is there anything I can check?
Any particular file, any trace or evidence of why the box is recurrently restarting?

For example, the last reboot occurred between 15pm and 19pm yesterday, and the TAC still can't find a possible root-cause of the problem.

Thanks for your comments.

Re: Unexpected Reboots

Tal_Paz-Fridman — Wed, 26 Mar 2025 18:00:15 GMT

Are there any Core Dumps or Kernel Crashes from that time frame?

I would also look at the messages files from that time frame for any potential causes.

Re: Unexpected Reboots

Matlu — Wed, 26 Mar 2025 18:13:38 GMT

Hi,

Core Dumps and Kernel Crashes, in which GW path are they hosted?

Revising the messages in this scenario is still an option?

Cheers

Re: Unexpected Reboots

Tal_Paz-Fridman — Wed, 26 Mar 2025 18:20:56 GMT

Core Dumps -> /var/log/dump/usermode

Kernel Crashes -> /var/log/crash/

Messages -> /var/log/ -> messages and all the ones after messages.*

Re: Unexpected Reboots

the_rock — Wed, 26 Mar 2025 18:25:45 GMT

Hey bro,

Just check what @Tal_Paz-Fridman provided and if you see anything relevant there, upload to TAC case via sftp account and they can analyze.

Andy

Re: Unexpected Reboots

Lesley — Wed, 26 Mar 2025 19:48:09 GMT

Run hcp -r all on problem unit. This will also show core dumps etc. Easy way for diagnostics.

What version and take you run? cpinfo -y all

If version is ok and no core dumps etc maybe hardware diag is needed:

https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_Gaia_AdminGuide/Content/Topics-GAG/Hardware-Diagnostics.htm

Maybe unit is running hot and shutdowns etc. It is not always software issue

Re: Unexpected Reboots

the_rock — Thu, 27 Mar 2025 03:49:08 GMT

Thats an excellent point @Lesley

Andy

Re: Unexpected Reboots

AkosBakos — Thu, 27 Mar 2025 08:27:23 GMT

Hi @Matlu

What do you see in fwk.elg and fwk_wd.elg?

eg.: grep "FWK crashed" /var/log/opt/CPsuite-R81.20/fw1/log/fwk_wd.elg

Increase the ticket priotity by TAC to Critical. They will join shortly and do an on-the-fly investigation.

Akos

Re: Unexpected Reboots

MichaelOZ — Thu, 27 Mar 2025 16:10:01 GMT

I have reached out by private message for more information. I'm happy to look into this for you.

Re: Unexpected Reboots

the_rock — Sat, 29 Mar 2025 18:37:29 GMT

Hey bro,

Do you have any update on this issue?

Andy

Re: Unexpected Reboots

Matlu — Sat, 29 Mar 2025 19:04:45 GMT

Hello,

The problem is still being reviewed by the CT.

They can't find the error.

Today the box went down again at 00:00 and did not pick up again, we had to restart the box manually, to get it to pick up again, and when it turned on, it turned on with errors, the Cluster VSX, picked up broken.

It really is a headache.

CT is checking Core Dumps, Crash Files, Hardware Diagnostic, CPinfo and still can't find a concrete answer.

Let's hope for a mirale. 🥲

Re: Unexpected Reboots

the_rock — Sat, 29 Mar 2025 19:38:32 GMT

Thats unfortunate...lets hope for the best.

Andy

Re: Unexpected Reboots

Chris_Atkinson — Sun, 30 Mar 2025 00:21:12 GMT

Could you please share the version/JHF level of the system?

Re: Unexpected Reboots

Lesley — Sun, 30 Mar 2025 09:02:31 GMT

Does it always crash a specific time? right at 00.00 is a bit suspicious. any cron jobs at that moment? Or IPS/AV/AB updates etc?

Re: Unexpected Reboots

the_rock — Sun, 30 Mar 2025 13:29:33 GMT

Not sure if it might be worth installing jumbo 99 if you are on R81.20...

Andy

Re: Unexpected Reboots

the_rock — Sun, 30 Mar 2025 14:47:56 GMT

Excellent point Lesley!

Re: Unexpected Reboots

Matlu — Sun, 30 Mar 2025 20:02:30 GMT

Hi,

R81.20 with JHF Take 84

The device restarts unexpectedly from time to time.
Sometimes it lifts quickly, and other times it takes many hours to lift, and it becomes necessary to force its recovery manually and manually.

Cheers

Re: Unexpected Reboots

Matlu — Sun, 30 Mar 2025 20:04:07 GMT

Hello,

It restarts at any time, it does not have an exact time.
What it is exact, is that the box, at the least thought moment, falls, and sometimes we have to force its ignition manually.

Cheers.

Re: Unexpected Reboots

the_rock — Sun, 30 Mar 2025 20:18:01 GMT

Hey bro,

Honestly, if I were you, I would install jumbo 99. At this point, it cant make it worse, only better.

Andy

Re: Unexpected Reboots

Chris_Atkinson — Sun, 30 Mar 2025 23:46:54 GMT

Some relevant fixes in JHF takes released since potentially include:

PRJ-56673, PRHF-35637: Memory corruption occurs when a bond interface is configured, leading to a Security Gateway crash with a vmcore or a boot loop.

PRJ-56480, PMTR-107271: In some scenarios, the VSX cluster can take extra time to boot up and activate the Virtual Systems.