topic Re: Policy install failure in Firewall and Security Management

Policy install failure

Gary_Scott — Wed, 02 May 2018 12:59:24 GMT

Has anyone ran into this error installing policy to 80.10 gateways?

FWInstallPolicyAppKernel        ERROR           cmi.c                           1486            fwk_cmi_prepare                                         cmi_                   loader: Failed to deserialize context 129. This may be caused by too many signatures applied to this context
06:53:24        2000096         InternalMsg             FWInstallPolicyAppKernel        ERROR           fwatom.c                        8364            fwk_atomic_load_prepare                                 'CMI                   ' load prepare failed
06:53:24        2000080         InternalMsg             FWInstallPolicyAppKernel        ERROR           fwk_install_policy_app.c        207             fwk_install_policy_app_load_prepare                     'fwk                   _atomic_load_prepare' failed
06:53:24        2               GuiMsg                  FW1                             ERROR           install_policy_mgr_kernel.c     860             install_policy_mgr_k_load_prepare                       Poli                   cy installation failed on gateway. If the problem persists contact Check Point support (Error code: 0-2000195).

Re: Policy install failure

Joshua_Hatter — Wed, 02 May 2018 18:01:25 GMT

I would recommend opening a request with support. I see one other SR with similar message. The Support Engineer was able to confirm through debugging a scenario from SK33893.

Re: Policy install failure

Gary_Scott — Wed, 02 May 2018 18:06:49 GMT

A reboot of the gateway allowed for the policy install to be successful. Would still love to know what is the possible cause for Error code: 0-2000195.

Re: Policy install failure

Benoit_Verove — Wed, 24 Oct 2018 13:38:48 GMT

I have exactly the same error on a member of a cluster (R80.10). I'll try to debug before rebooting. I will post the results of my investigation.

Any idea is welcome.

Regards,

Benoit

Re: Policy install failure

Benoit_Verove — Wed, 24 Oct 2018 20:33:22 GMT

My customer has finally rebooted his gateway. It solved the installation failure.

Regards

Re: Policy install failure

Benoit_Verove — Thu, 08 Nov 2018 14:40:49 GMT

Hi,

The issue occurred one more time.

This time, I had time to investigate.

In my case, the gateway is a 12600 appliance. It was handling more than 120 000 connections in R80.10 with latest jumbo.Blades used: FW, AppC, VPN, URLF, AV, AB.

Management on a VM.

The appliance simply needed more memory. The defaultt 6 GB were not enought and the appliance was swapping

Adding 6 x 1GB RAM solved the policy installation failure... so far.

Regards,

Benoit

Re: Policy install failure

Peter_Sithole — Sat, 09 Mar 2019 21:17:08 GMT

Restart of the gateway and push the policy again will resolve Error code:0-2000195

Re: Policy install failure

zekiesenalp — Wed, 21 Apr 2021 08:35:07 GMT

I had same problem with the R80.30 CP5800 gateway with 80.40 management. Restarting solved the problem

Re: Policy install failure

Ilya_Yusupov — Sun, 25 Apr 2021 11:07:01 GMT

hi @Gary_Scott ,

It looks like memory issue, you can check under cpview history if you have any SMEM failuers under ==> Advanced ==> memory ==> SMEM failures.

Thanks,

Ilya

Re: Policy install failure

Ilya_Yusupov — Sun, 25 Apr 2021 14:12:33 GMT

Hi @zekiesenalp ,

can you please check if you had any SMEM failures under cpview history?

Thanks,

Ilya

Re: Policy install failure

the_rock — Sun, 25 Apr 2021 15:34:55 GMT

I saw this issue with one customer and the way we fixed it was by changing connection settings from 25000 to automatic on cluster properties. Not sure why that fixed the problem, as when we ran fw tab -t connections -s, it showed peak of 17000, but somehow chancing that option worked. TAC was never able to give client a good reason for this, but we never really pursued it much, since the problem got solved. Still, it would be nice to know the reason...

Re: Policy install failure

Lijo_mathai — Tue, 04 May 2021 10:01:34 GMT

I am too facing the same issue. Is there a way to find the cause of this error?

Re: Policy install failure

Lijo_mathai — Tue, 04 May 2021 10:11:33 GMT

Hi, Yes i found SMEM failures under my cpview history. Can i understand what this failure means and how to rectify this.

Re: Policy install failure

Ilya_Yusupov — Tue, 04 May 2021 10:13:57 GMT

I will take it offline with you

Thanks,

Ilya

Re: Policy install failure

Lijo_mathai — Tue, 04 May 2021 15:34:30 GMT

Hi, I managed to solve the issue. Actually it was the CCP which was causing the cluster interface to show as down and due to which the standby box in clusterXL also went down. When i did the necessary config on the switches the interface came back to normal. Thanks