topic Re: 2200 appliacne R80.20 failure in General Topics

2200 appliacne R80.20 failure

Wolfgang — Fri, 14 Jun 2019 06:15:51 GMT

Dear folks,

we are running R80.20 on an 2200 appliance since 2 month without problems.

This week some problems occurs. We got a lot of errors like these:

Jun 13 11:19:25 2019 XXXXX kernel: [fw4_0];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=1 flags=1 opcode=15)
Jun 13 11:19:26 2019 XXXXX kernel: [fw4_0];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=1 flags=1 opcode=15)
Jun 13 11:19:26 2019 XXXXX kernel: [fw4_0];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=0 flags=1 opcode=15)

If we do a restart of the appliance they can't install policy (policy install failed) and default policy is loaded.

A manual fw fetch after restart loads the actual policy, but the shown errors occurs again after some minutes.

Any ideas or seen this error anywhere?

Wolfgang

Re: 2200 appliacne R80.20 failure

NSerrao — Fri, 14 Jun 2019 10:24:58 GMT

Hi.

I'm having this same issue on our R80.20.

It started a few days ago, right after Take 80 update instalation:

Jun 14 11:13:14 SPA-GW kernel: [fw4_2];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=0 flags=1 opcode=15)
Jun 14 11:13:16 SPA-GW kernel: [fw4_1];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=0 flags=1 opcode=15)
Jun 14 11:13:17 SPA-GW kernel: [fw4_2];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=0 flags=1 opcode=15)
Jun 14 11:13:17 SPA-GW kernel:
Jun 14 11:13:17 SPA-GW kernel: FW-1: stopping debug messages for the next 43 seconds
Jun 14 11:13:17 SPA-GW kernel: [fw4_1];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=0 flags=1 opcode=15)
Jun 14 11:13:21 SPA-GW last message repeated 4 times
Jun 14 11:13:21 SPA-GW kernel: [fw4_0];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=0 flags=1 opcode=15)

It's spaming our syslog...

Our support created a ticket on checkpoint and the answer was:

"We have few other customers who have reported same messages after upgrading the machine. The issue is currently under investigation of the R&D team, will update you with more information as and when received."

(12/06/2019 - 14:17)

I can say that there's no negative impact so far.

Hope checkpoint solve this soon.

Best regards.

Nserrao

Re: 2200 appliacne R80.20 failure

Wolfgang — Fri, 14 Jun 2019 16:54:40 GMT

Nserrao,

makes sense. We installed take 80 to solve sk149413 issue.
I'll contact TAC for the problem.

Thanks for your information
Wolfgang

Re: 2200 appliacne R80.20 failure

Thomas_Eichelbu — Thu, 20 Jun 2019 17:48:51 GMT

Hello i have the same issue on a fresh installed 5200 appliance with R80.20 and take 80:
@;105811;[cpu_1];[fw4_0];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=0 flags=1 opcode=15);
@;105811;[cpu_1];[fw4_0];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=0 flags=1 opcode=15);
@;105811;[cpu_1];[fw4_0];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=0 flags=1 opcode=15);
@;105811;[cpu_1];[fw4_0];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=0 flags=1 opcode=15);
@;105811;[cpu_1];[fw4_0];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=1 flags=1 opcode=15);

but i dont feel any negative impact so far ...

please provide us with the outcome of your Tace case!

best regards
Thomas.

Re: 2200 appliacne R80.20 failure

NSerrao — Fri, 21 Jun 2019 09:07:14 GMT

Hello.

Our local support team reply me the following as solution:

Install the latest build of CPUSE Agent from sk92449.
Connect to command line on target Gaia OS.
Log in to Clish.
Acquire the lock over Gaia configuration database:
HostName:0> lock database override
Import the package from the hard disk:
Note: When import completes, this package is deleted from the original location.
HostName:0> installer import local /.TGZ_or_TAR
Show the imported packages:
Note: Refer to the top section "Hotfixes" - refer to "Check Point R80.20 Jumbo hotfix T<number> for sk137592"
HostName:0> show installer packages imported
Verify that this R80 Jumbo Hotfix Accumulator package can be installed without conflicts:
HostName:0> installer verify
Install the imported package:
HostName:0> installer install

Didn't test it yet but I'll came back with news when it's done.

Best regards.

Nelson

Re: 2200 appliacne R80.20 failure

Shawn_Fletcher — Thu, 11 Jul 2019 22:44:32 GMT

Just upgrade to R80.20 Take 87 per TAC.

Also seeing the messages , several per second

Jul 11 18:40:36 2019 SJHFW1 kernel: [fw4_6];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=2 flags=1 opcode=15)
Jul 11 18:40:36 2019 SJHFW1 kernel: [fw4_9];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=2 flags=1 opcode=15)
Jul 11 18:40:36 2019 SJHFW1 kernel: [fw4_6];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=2 flags=1 opcode=15)
Jul 11 18:40:36 2019 SJHFW1 kernel: [fw4_6];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=2 flags=1 opcode=15)
Jul 11 18:40:36 2019 SJHFW1 kernel: [fw4_6];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=0 flags=1 opcode=15)
Jul 11 18:40:36 2019 SJHFW1 kernel: [fw4_6];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=0 flags=1 opcode=15)
Jul 11 18:40:36 2019 SJHFW1 kernel: [fw4_9];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=0 flags=1 opcode=15)
Jul 11 18:40:36 2019 SJHFW1 kernel: [fw4_9];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=2 flags=1 opcode=15)
Jul 11 18:40:36 2019 SJHFW1 kernel: [fw4_9];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=0 flags=1 opcode=15)
Jul 11 18:40:36 2019 SJHFW1 kernel: [fw4_6];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=2 flags=1 opcode=15)
Jul 11 18:40:36 2019 SJHFW1 kernel: [fw4_7];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=2 flags=1 opcode=15)
Jul 11 18:40:36 2019 SJHFW1 kernel: [fw4_7];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=1 flags=1 opcode=15)
Jul 11 18:40:36 2019 SJHFW1 kernel: [fw4_4];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=0 flags=1 opcode=15)
Jul 11 18:40:36 2019 SJHFW1 kernel: [fw4_4];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=0 flags=1 opcode=15)
Jul 11 18:40:37 2019 SJHFW1 kernel: [fw4_11];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=1 flags=1 opcode=15)
Jul 11 18:40:37 2019 SJHFW1 kernel: [fw4_11];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=1 flags=1 opcode=15)
Jul 11 18:40:37 2019 SJHFW1 kernel: [fw4_2];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=1 flags=1 opcode=15)
Jul 11 18:40:37 2019 SJHFW1 kernel: [fw4_2];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=1 flags=1 opcode=15)
Jul 11 18:40:37 2019 SJHFW1 kernel: [fw4_4];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=1 flags=1 opcode=15)
Jul 11 18:40:37 2019 SJHFW1 kernel: [fw4_4];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=1 flags=1 opcode=15)
Jul 11 18:40:38 2019 SJHFW1 kernel: [fw4_0];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=2 flags=1 opcode=15)
Jul 11 18:40:38 2019 SJHFW1 kernel: [fw4_4];fwmutlik_do_sequence_accounting_on_entry: bad dir -1 (gconn_segment=1 flags=1 opcode=15)
(END)

Re: 2200 appliacne R80.20 failure

Ophir_Grinstein — Thu, 25 Jul 2019 15:57:59 GMT

Hello,

I would like to bring clarity into this thread discussion

After installing R80.20 Jumbo HFA Take 80, the following error messages can appear in dmesg:
- fwmutlik_do_sequence_accounting_on_entry: bad dir
This issue is cosmetic and can be ignored. There is no impact to the system
Fix for this is integrated into R80_20 Jumbo Hotfix starting from take 91
See sk158312 for more reference

Thanks,

Ophir

Re: 2200 appliacne R80.20 failure

NSerrao — Thu, 25 Jul 2019 16:05:21 GMT

Hello.

Thank you for your reply.

We also updated R80.20 into take 87 last week but it's still spamming our syslog.

We'll ignore those messages and wait for take 91.

Best regards.

Nelson

Re: 2200 appliacne R80.20 failure

Shawn_Fletcher — Thu, 25 Jul 2019 16:14:09 GMT

i had to request a hotfix for take 87, so one is available through tac

Re: 2200 appliacne R80.20 failure

Raj_Khatri — Tue, 30 Jul 2019 11:49:08 GMT

What version did you upgrade from? I am trying to upgrade from R77.30 to R80.20 and while the upgrade wizard says to use this file, it fails to upload via offline CPUSE and says not compatible.

Check_Point_R80.20_T101_Fresh_Install_and_Upgrade_Security_Management.tgz

Re: 2200 appliacne R80.20 failure

Wolfgang — Tue, 30 Jul 2019 12:29:52 GMT

Raj,

you used the image with security management software only.

2200 appliances supports only gateway with R80.xx. (shown in your screenshot)

R80.20 Fresh Install and Upgrade for Security Gateway and Standalone

regards

Wolfgang

Re: 2200 appliacne R80.20 failure

Raj_Khatri — Tue, 30 Jul 2019 12:36:24 GMT

Ah, good catch. Thanks for that, too early for me! Appreciate it....