topic Re: Error with IPS in Firewall and Security Management

Error with IPS

Matlu — Tue, 01 Jul 2025 16:37:16 GMT

Hello, Mates.

We have a VSX Cluster, in which one of our VS, has enabled the Threat Prevention layer (IPS/AV/AB).

We are having problems installing policies in the TP layer, but it does not show us the “because” error, only the message “Failed” appears.

Is it possible to recognize the cause of this error?

Thanks for your comments.

Re: Error with IPS

Tal_Paz-Fridman — Tue, 01 Jul 2025 16:57:00 GMT

An Internal Error indicates a malfunction in the system for which we do not have enough information to provide a clear explanation or validation.

Suggestions:

Since this may relate to verification processes, review any recent changes and try to isolate the cause.
If the issue persists, open a ticket with Check Point Support (TAC), as further investigation might be required.

Re: Error with IPS

Matlu — Tue, 01 Jul 2025 17:00:10 GMT

Hi @Tal_Paz-Fridman

This error may be the result of a misconfiguration of security rules in the VS?

A wrongly created rule, or something similar?

Re: Error with IPS

Tal_Paz-Fridman — Tue, 01 Jul 2025 17:16:51 GMT

Yes, but normally through design and testing, we ensure that all such cases are handled - either by avoiding errors entirely or by providing user-friendly messages with clear instructions. This case is an exception, as the message shown is neither user-friendly nor informative about what went wrong or how to resolve it.

Still you can still try to reverse some steps to isolate the issue and find a W/A.
TAC should be involved if a deeper solution is required.

Re: Error with IPS

PhoneBoy — Tue, 01 Jul 2025 17:56:07 GMT

Assuming the problem persists, you're probably going to need to run a debug on the policy installation process: https://support.checkpoint.com/results/sk/sk159452
You may be able to figure out the issue from the debug, but if not, a TAC case will be necessary.

Re: Error with IPS

Lesley — Tue, 01 Jul 2025 19:55:46 GMT

Try to push ONLY threat prevention policy without normal policy push.

If you enable this blade for the first time you cannot push policy both at the same time.