topic Re: Checkpoint Policy Installation Failed in Checkpoint Mangement Server in Firewall and Security Management

Checkpoint Policy Installation Failed in Checkpoint Mangement Server

Rabin — Tue, 07 Jan 2025 11:56:25 GMT

Dear Checkmates,

Greetings,

We are not able to install the policy after installing the eval license. The managment server shows that the access policy installation failed while threat prevention policy gets installed. We could fetch policy through gateway and through management_cli api but cannot push through the smartconsole.

If yo had encounterd the issue or have any ideas please share. I have attached the screenshot of the erros.

Thank You.

Regards,

Rabindra Khadka

Re: Checkpoint Policy Installation Failed in Checkpoint Mangement Server

G_W_Albrecht — Tue, 07 Jan 2025 12:06:33 GMT

Did you resolve the errors shown already ? I would bet that the policy does not even get compiled and policy fetch from GW just loads the old policy...

Re: Checkpoint Policy Installation Failed in Checkpoint Mangement Server

Rabin — Tue, 07 Jan 2025 12:09:58 GMT

Hi @G_W_Albrecht ,

No luck, still we cannot push the policy from smartconsole. As observer from the gateway we can fetch the policy but i am not sure whether its new or old one. Is there any thing that we could try here ?.

Thank You.

Re: Checkpoint Policy Installation Failed in Checkpoint Mangement Server

G_W_Albrecht — Tue, 07 Jan 2025 13:48:10 GMT

What is shown if you just verify the policy ? What is the error if the old errors have been fixed ? And please provide a screenshot with all lines from the Policy install window...

Re: Checkpoint Policy Installation Failed in Checkpoint Mangement Server

the_rock — Tue, 07 Jan 2025 12:51:53 GMT

Hey Rabindra,

Please try to verify policy like @G_W_Albrecht suggested, so we can see why its failing. There must be something causing this, since warnings showing in the screenshot are simply that, just warnings, it would not fail because of that.

Andy

(view in My Videos)

Re: Checkpoint Policy Installation Failed in Checkpoint Mangement Server

AkosBakos — Tue, 07 Jan 2025 13:15:09 GMT

Hi @Rabin

You wanted to install the Threat Prevention policy only as I see.

You are able to install the Access Control policy, or do you get the same error?
As I remember you was the person who asked about Content Awareness yesterday.
- did you apply any RegExp in the filename section?

Akos

Re: Checkpoint Policy Installation Failed in Checkpoint Mangement Server

G_W_Albrecht — Tue, 07 Jan 2025 13:10:47 GMT

This could be more than warnings as we do not see all lines right of Access policy, but top line policy verification failed is a grave error that will make the policy not installable...

So show all lines please!

Re: Checkpoint Policy Installation Failed in Checkpoint Mangement Server

the_rock — Tue, 07 Jan 2025 13:16:22 GMT

@AkosBakos is right actually, seems like its related to threat prevention policy, but yes, agree, we need to see all the lines.

Andy

Re: Checkpoint Policy Installation Failed in Checkpoint Mangement Server

G_W_Albrecht — Tue, 07 Jan 2025 13:17:24 GMT

Where do you see that he wanted to install the Threat Prevention policy only ? That selection is not shown. As TP policy install has succeeded, it is the enlarged Access policy part that is mostly hidden and has warnings in the shown lines, and you see that Access policy install failed on top...

Re: Checkpoint Policy Installation Failed in Checkpoint Mangement Server

the_rock — Tue, 07 Jan 2025 13:20:45 GMT

See below. Though based on the message, appears its failing for a different gateway.

Andy

Re: Checkpoint Policy Installation Failed in Checkpoint Mangement Server

Chris_Atkinson — Tue, 07 Jan 2025 13:28:13 GMT

Please provide more details of the actual error and version/JHF of the relevant components.

Side note R80.30 is EOL

Re: Checkpoint Policy Installation Failed in Checkpoint Mangement Server

AkosBakos — Tue, 07 Jan 2025 13:29:29 GMT

Hu @G_W_Albrecht

I linked this issue to this behind the scenes.

Akos

Re: Checkpoint Policy Installation Failed in Checkpoint Mangement Server

G_W_Albrecht — Tue, 07 Jan 2025 13:37:06 GMT

That is wrong.The line for TP policy Succeeded is only one line without warnings, or else it would look like:

but the Access policy line is expanded, see the

- from Policy Installation failed down the warnings belong to Access Policy...

I do not really understand how you as a long-time CP specialist make such mistakes, this is all obvious from the screenshot...

Re: Checkpoint Policy Installation Failed in Checkpoint Mangement Server

G_W_Albrecht — Tue, 07 Jan 2025 13:41:49 GMT

So where do the warnings come from if TP is installed successfully (that is, without warnings and errors) ?

You can see all in the screenshot (except the access policy line and further lines right from it, that would be the most important lines to show)

Re: Checkpoint Policy Installation Failed in Checkpoint Mangement Server

the_rock — Tue, 07 Jan 2025 13:41:50 GMT

Its not really clear to me, sorry. Im simply going by what I see and what I see it shows threat prevention policy. Unless I look at the whole thing, I cant tell.

Btw, Im not any type of guru or specialist, not even close haha

Andy

Re: Checkpoint Policy Installation Failed in Checkpoint Mangement Server

G_W_Albrecht — Tue, 07 Jan 2025 13:46:10 GMT

If it is succeeding, it has no warnings, as in the screenshot. In my screenshot, it succeeds with warnings, this is shown differently. As it just succeeds, the warning below Policy Install failed belong to the Access Policy.

But blunder or not, we will need to see all lines for any suggestions.

Re: Checkpoint Policy Installation Failed in Checkpoint Mangement Server

the_rock — Tue, 07 Jan 2025 13:50:38 GMT

I agree. You are right its most likely regular policy, since even verification would only work for access policy, not threat prevention one, but lets see if @Rabin can send us the exact failure, will be easier to help.

Andy

Re: Checkpoint Policy Installation Failed in Checkpoint Mangement Server

Rabin — Tue, 07 Jan 2025 13:55:45 GMT

Hi Everyone,

Regarding this issus, just wanted to provide the quick update on this issue. The current checkpoint appliances are in R80.30 version with the latest hotfix take 255 and same goes for another cluster which has R81.10 version with latest hotfix take 172 with same issue.

We have verified the policy before installing the policies which get successfully verified. We checked the resource utilization seems normal, collected the cpd.elg logs for furhter analysis. As far as the screenshot is concerned there are only warning for application blades for https inspection and some source and destination with any which are not recommended.

Will post the detailed screenshot shortly.

Thank You.

Re: Checkpoint Policy Installation Failed in Checkpoint Mangement Server

the_rock — Tue, 07 Jan 2025 13:58:20 GMT

That would 100% help us. Its a bit odd if you only see warnings, since policy would never fail due to those. Anyway, once you send the full error, Im sure we will fix it quick.

Andy

Re: Checkpoint Policy Installation Failed in Checkpoint Mangement Server

Rabin — Tue, 07 Jan 2025 14:06:32 GMT

Dear All,

Please find the attached screenshot here: