topic Re: Checkpoint Policy Installation failed on gateway. Error code: 0-2000240 in Firewall and Security Management

Checkpoint Policy Installation failed on gateway. Error code: 0-2000240

Theo — Mon, 27 Apr 2020 10:48:17 GMT

Device Information

Appliance: CheckPoint 2200

OS: Gaia

Version R80.30

Type: Standalone gateway

Current Utilization: CPU= 3%; Memory 88%

Problem

When installing policy from Smart Console, I either got the following error and failed

Checkpoint Policy Installation failed on gateway. Error code: 0-2000240
Installation failed. Reason: Policy install commit function was unsuccessful due to timeout
Policy installation failed on gateway. If the problem persists contact Check Point support (Error code:0-2000108)

Appreciate your help in giving possible root cause.

Re: Checkpoint Policy Installation failed on gateway. Error code: 0-2000240

Timothy_Hall — Mon, 27 Apr 2020 12:26:33 GMT

The 2200 is a box with very limited CPU and memory, what does output of these commands show:

free -m

enabled_blades

netstat -ni

The policy installation failure is probably caused by lack of free memory on the 2200 causing the commit/atomic load to fail.

Re: Checkpoint Policy Installation failed on gateway. Error code: 0-2000240

Theo — Mon, 27 Apr 2020 12:58:54 GMT

hi @Timothy,

thanks for the feedback. see below

=~=~=~=~=~=~=~=~=~=~=~= PuTTY log 2020.04.27 20:51:59 =~=~=~=~=~=~=~=~=~=~=~=
expert
Enter expert password:

Warning! All configurations should be done through clish
You are in expert mode now.

]0;admin@fw-csg-mid-J-HQ:~[Expert@fw-HQ:0]# free -m
total used free shared buffers cached
Mem: 1868 1856 11 0 5 187
-/+ buffers/cache: 1663 204
Swap: 4094 736 3358
]0;admin@fw-HQ:~[Expert@fw-HQ:0]# enabled_blades
fw vpn urlf av appi ips identityServer anti_bot vpn
]0;admin@fw-HQ:~[Expert@fw-HQ:0]# netstat -ni
Kernel Interface table
Iface MTU Met RX-OK RX-ERR RX-DRP RX-OVR TX-OK TX-ERR TX-DRP TX-OVR Flg
Mgmt 1500 0 0 0 0 0 0 0 0 0 BMU
Mgmt:1 1500 0 - no statistics available - BMU
bond0 1500 0 15532130 0 238 0 14806305 0 0 0 BMmRU
bond0.2 1500 0 10825280 0 0 0 10394955 0 0 0 BMmRU
bond0.3 1500 0 2678458 0 0 0 2995841 0 0 0 BMmRU
bond0.4 1500 0 0 0 0 0 113022 0 0 0 BMmRU
bond0.5 1500 0 87150 0 0 0 334849 0 0 0 BMmRU
bond0.6 1500 0 898888 0 0 0 275932 0 0 0 BMmRU
bond0.8 1500 0 693274 0 0 0 691700 0 0 0 BMmRU
eth1 1500 0 24118473 0 62753 0 21087016 0 0 0 BMRU
eth3 1500 0 349078 0 0 0 0 0 0 0 BMsRU
eth4 1500 0 15183052 0 238 0 14806305 0 0 0 BMsRU
lo 16436 0 762450 0 0 0 762450 0 0 0 LRU
]0;admin@fw-HQ:~[Expert@fw-HQ:0]# fw ver
This is Check Point's software version R80.30 - Build 078
]0;admin@fw-HQ:~[Expert@fw-HQ:0]# exit
exit
fw-HQ> exit

Re: Checkpoint Policy Installation failed on gateway. Error code: 0-2000240

Timothy_Hall — Mon, 27 Apr 2020 14:08:40 GMT

Yeah as I suspected, way short on memory for what you are asking the box to do. You are 736MB into swap on a box that only has 2GB of RAM. More RAM will help a lot, although the 2200's are not "officially" upgradeable as far as memory if you get my drift. If you can't push policy, reboot the box to free up some memory and try again. Not an ideal solution, but when the box is that far oversubscribed for memory there is not much you can do other than disabling features and occasional reboots.

A 3200 appliance is the recommended replacement...

Re: Checkpoint Policy Installation failed on gateway. Error code: 0-2000240

Theo — Tue, 28 Apr 2020 10:56:55 GMT

Upgrading is not an option at the moment. Stick on the current setup 🙂

Disabling some blades could help?

Re: Checkpoint Policy Installation failed on gateway. Error code: 0-2000240

Timothy_Hall — Tue, 28 Apr 2020 12:04:14 GMT

Yes, try disabling IPS first and see how that impacts memory usage after a reboot. Then perhaps AV.