I get a peculiar message after upgrading to R80.40.

ChoiYunSoo — Fri, 08 Jan 2021 09:01:08 GMT

Hello, nice to meet you

The customer's firewall is sg23800 and using a firewall and IPS blade.

I upgraded the customer's firewall from r80.10 to r80.40.

Since then, peculiar messages constantly appear on the customer's firewall.

It seems that the parser in the process of inspecting IPS traffic on the instance is involved, but I am not sure what is the exact cause.

If the message persists, I am worried that there will be service related issues.

Jan 7 07:31:10 2021 LGESA_GW_FW1 kernel: [fw4_2];[10.189.224.153:2321 -> 27.122.144.11:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc900729130e0), opt_info(          (null))
Jan 7 07:31:10 2021 LGESA_GW_FW1 kernel: [fw4_2];[10.189.224.153:2321 -> 27.122.144.11:80] [ERROR]: cmik_loader_fw_dyn_parsers_is_set_http_session_skipping: cmik_loader_fw_set_http_skipping_val() failed
Jan 7 07:31:12 2021 LGESA_GW_FW1 kernel: [fw4_38];[10.189.224.153:2322 -> 27.122.144.11:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc901ba436608), opt_info(          (null))
Jan 7 07:31:12 2021 LGESA_GW_FW1 kernel: [fw4_38];[10.189.224.153:2322 -> 27.122.144.11:80] [ERROR]: cmik_loader_fw_dyn_parsers_is_set_http_session_skipping: cmik_loader_fw_set_http_skipping_val() failed
Jan 7 07:31:33 2021 LGESA_GW_FW1 kernel: [fw4_33];[10.189.224.153:2334 -> 27.122.144.11:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc90076f50870), opt_info(          (null))
Jan 7 07:31:33 2021 LGESA_GW_FW1 kernel: [fw4_33];[10.189.224.153:2334 -> 27.122.144.11:80] [ERROR]: cmik_loader_fw_dyn_parsers_is_set_http_session_skipping: cmik_loader_fw_set_http_skipping_val() failed
Jan 7 07:31:44 2021 LGESA_GW_FW1 kernel: [fw4_36];[10.189.224.153:2342 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc904014bc1e8), opt_info(          (null))
Jan 7 07:31:44 2021 LGESA_GW_FW1 kernel: [fw4_36];[10.189.224.153:2342 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_dyn_parsers_is_set_http_session_skipping: cmik_loader_fw_set_http_skipping_val() failed
Jan 7 07:31:46 2021 LGESA_GW_FW1 kernel: [fw4_25];[10.189.224.153:2343 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc90099f90608), opt_info(          (null))
Jan 7 07:31:46 2021 LGESA_GW_FW1 kernel: [fw4_25];[10.189.224.153:2343 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_dyn_parsers_is_set_http_session_skipping: cmik_loader_fw_set_http_skipping_val() failed
Jan 7 07:31:50 2021 LGESA_GW_FW1 kernel: [fw4_28];[10.189.224.153:2345 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc900368b5660), opt_info(          (null))
Jan 7 07:31:50 2021 LGESA_GW_FW1 kernel: [fw4_28];[10.189.224.153:2345 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_dyn_parsers_is_set_http_session_skipping: cmik_loader_fw_set_http_skipping_val() failed
Jan 7 07:31:51 2021 LGESA_GW_FW1 kernel: [fw4_20];[10.189.224.153:2346 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc9049002cc38), opt_info(          (null))
Jan 7 07:31:51 2021 LGESA_GW_FW1 kernel: [fw4_20];[10.189.224.153:2346 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_dyn_parsers_is_set_http_session_skipping: cmik_loader_fw_set_http_skipping_val() failed
Jan 7 07:31:51 2021 LGESA_GW_FW1 kernel: [fw4_2];[10.189.224.153:2347 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc900a9819920), opt_info(          (null))
Jan 7 07:31:51 2021 LGESA_GW_FW1 kernel: [fw4_2];[10.189.224.153:2347 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_dyn_parsers_is_set_http_session_skipping: cmik_loader_fw_set_http_skipping_val() failed
Jan 7 07:31:51 2021 LGESA_GW_FW1 kernel: [fw4_37];[10.189.224.153:2348 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc904613e20e0), opt_info(          (null))
Jan 7 07:31:51 2021 LGESA_GW_FW1 kernel: [fw4_37];[10.189.224.153:2348 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_dyn_parsers_is_set_http_session_skipping: cmik_loader_fw_set_http_skipping_val() failed
Jan 7 07:31:51 2021 LGESA_GW_FW1 kernel: [fw4_33];[10.189.224.153:2349 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc90324ac2978), opt_info(          (null))
Jan 7 07:31:51 2021 LGESA_GW_FW1 kernel: [fw4_33];[10.189.224.153:2349 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_dyn_parsers_is_set_http_session_skipping: cmik_loader_fw_set_http_skipping_val() failed
Jan 7 07:31:51 2021 LGESA_GW_FW1 kernel: [fw4_36];[10.189.224.153:2350 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc9041ce7f5b0), opt_info(          (null))
Jan 7 07:31:51 2021 LGESA_GW_FW1 kernel: [fw4_36];[10.189.224.153:2350 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_dyn_parsers_is_set_http_session_skipping: cmik_loader_fw_set_http_skipping_val() failed
Jan 7 07:31:51 2021 LGESA_GW_FW1 kernel: [fw4_4];[10.189.224.153:2351 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc9028ff6c240), opt_info(          (null))
Jan 7 07:31:51 2021 LGESA_GW_FW1 kernel: [fw4_4];[10.189.224.153:2351 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_dyn_parsers_is_set_http_session_skipping: cmik_loader_fw_set_http_skipping_val() failed
Jan 7 07:31:53 2021 LGESA_GW_FW1 kernel: [fw4_34];[10.189.224.153:2355 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc9008b8c5558), opt_info(          (null))
Jan 7 07:31:53 2021 LGESA_GW_FW1 kernel: [fw4_34];[10.189.224.153:2355 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_dyn_parsers_is_set_http_session_skipping: cmik_loader_fw_set_http_skipping_val() failed
Jan 7 07:31:54 2021 LGESA_GW_FW1 kernel: [fw4_14];[10.189.224.153:2356 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc901f907eea0), opt_info(          (null))
Jan 7 07:31:54 2021 LGESA_GW_FW1 kernel: [fw4_14];[10.189.224.153:2356 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_dyn_parsers_is_set_http_session_skipping: cmik_loader_fw_set_http_skipping_val() failed
Jan 7 07:31:54 2021 LGESA_GW_FW1 kernel: [fw4_13];[10.189.224.153:2357 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc90183c82e48), opt_info(          (null))
Jan 7 07:31:54 2021 LGESA_GW_FW1 kernel: [fw4_13];[10.189.224.153:2357 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_dyn_parsers_is_set_http_session_skipping: cmik_loader_fw_set_http_skipping_val() failed
Jan 7 07:31:54 2021 LGESA_GW_FW1 kernel: [fw4_14];[10.189.224.153:2359 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc9048d963ad8), opt_info(          (null))
Jan 7 07:31:54 2021 LGESA_GW_FW1 kernel: [fw4_14];[10.189.224.153:2359 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_dyn_parsers_is_set_http_session_skipping: cmik_loader_fw_set_http_skipping_val() failed
Jan 7 07:31:54 2021 LGESA_GW_FW1 kernel: [fw4_15];[10.189.224.153:2360 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc9026f3a7d98), opt_info(          (null))
Jan 7 07:31:54 2021 LGESA_GW_FW1 kernel: [fw4_15];[10.189.224.153:2360 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_dyn_parsers_is_set_http_session_skipping: cmik_loader_fw_set_http_skipping_val() failed
Jan 7 07:31:54 2021 LGESA_GW_FW1 kernel: [fw4_5];[10.189.224.153:2361 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc90287913978), opt_info(          (null))
Jan 7 07:31:54 2021 LGESA_GW_FW1 kernel: [fw4_5];[10.189.224.153:2361 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_dyn_parsers_is_set_http_session_skipping: cmik_loader_fw_set_http_skipping_val() failed
Jan 7 07:31:54 2021 LGESA_GW_FW1 kernel: [fw4_32];[10.189.224.153:2362 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc9018696edf0), opt_info(          (null))
Jan 7 07:31:54 2021 LGESA_GW_FW1 kernel: [fw4_32];[10.189.224.153:2362 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_dyn_parsers_is_set_http_session_skipping: cmik_loader_fw_set_http_skipping_val() failed
Jan 7 07:31:54 2021 LGESA_GW_FW1 kernel: [fw4_10];[10.189.224.153:2363 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc90238a0c6b8), opt_info(          (null))
Jan 7 07:31:54 2021 LGESA_GW_FW1 kernel: [fw4_10];[10.189.224.153:2363 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_dyn_parsers_is_set_http_session_skipping: cmik_loader_fw_set_http_skipping_val() failed
Jan 7 07:31:55 2021 LGESA_GW_FW1 kernel: [fw4_21];[10.189.224.153:2365 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc902deab7500), opt_info(          (null))
Jan 7 07:31:55 2021 LGESA_GW_FW1 kernel: [fw4_21];[10.189.224.153:2365 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_dyn_parsers_is_set_http_session_skipping: cmik_loader_fw_set_http_skipping_val() failed
Jan 7 07:31:55 2021 LGESA_GW_FW1 kernel: [fw4_16];[10.189.224.153:2366 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc903ddb9c0e0), opt_info(          (null))
Jan 7 07:31:55 2021 LGESA_GW_FW1 kernel: [fw4_16];[10.189.224.153:2366 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_dyn_parsers_is_set_http_session_skipping: cmik_loader_fw_set_http_skipping_val() failed
Jan 7 07:31:55 2021 LGESA_GW_FW1 kernel: [fw4_9];[10.189.224.153:2367 -> 27.122.144.17:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc902cf140b30), opt_info(          (null))

Thank you

Re: I get a peculiar message after upgrading to R80.40.

_Val_ — Fri, 08 Jan 2021 09:21:19 GMT

It looks like your streaming engine cannot find some definitions which are active. Please update your IPS & Application Control manually and re-push the policy. If the issue remains, please open a support call with TAC

Re: I get a peculiar message after upgrading to R80.40.

Mikael — Wed, 10 Feb 2021 11:41:10 GMT

Hi,

Did you ever find a solution to this issue. Was it resolved by updating the AppCtrl/URLF/IPS signatures?

Cheers

Re: I get a peculiar message after upgrading to R80.40.

ChoiYunSoo — Sun, 14 Feb 2021 04:33:06 GMT

No message appears after changing customer equipment from 23800 to 16200

It's hard to know what's the exact cause

Re: I get a peculiar message after upgrading to R80.40.

newGuyChris — Tue, 04 Apr 2023 15:23:05 GMT

Hey val,

I am also getting the same errors on R81.10 take 87. But I noticed something strange that may be a culprit of why the following messages are being presented. Client is using a proxy, the port :80 should be :8080

Mar 25 23:25:10 2023 xxxx kernel: [fw4_10];[x.x.26.111:26020 -> x.x.72.161:80] [ERROR]: cmik_loader_fw_set_http_skipping_val: bad args. cmi_opq(ffffc900fe7e4450), opt_info( (null))
Mar 25 23:25:10 2023 xxxx kernel: [fw4_10];[x.x.26.111:26020 -> x.x.72.161:80] [ERROR]: cmik_loader_fw_dyn_parsers_is_set_http_session_skipping: cmik_loader_fw_set_http_skipping_val() failed

These errors are present after an upgrade from R80.40 > R81.10 JHF 87. However from the below logs you can see that there are two versions of OS trying to run simultaneously.

Mar 25 08:33:06 2023 xxxx xpand[23012]: admin localhost t +installer:packages:Check_Point_R81.20_T631_Fresh_Install_and_Upgrade.tgz:has_metadata 0
Mar 25 08:33:06 2023 xxxx xpand[23012]: Configuration changed from localhost by user admin by the service dbset
Mar 25 08:33:06 2023 xxxx xpand[23012]: admin localhost t +installer:packages:Check_Point_R81.20_T631_Fresh_Install_and_Upgrade.tgz:has_metadata 1
Mar 25 08:33:06 2023 xxxx xpand[23012]: Configuration changed from localhost by user admin by the service dbset

and

Mar 25 08:33:10 2023 xxxx xpand[23012]: admin localhost t +installer:packages:Blink_image_1.1_Check_Point_R81.10_T335_SecurityGateway.tgz:has_metadata 0
Mar 25 08:33:10 2023 xxxx xpand[23012]: Configuration changed from localhost by user admin by the service dbset
Mar 25 08:33:10 2023 xxxx xpand[23012]: admin localhost t +installer:packages:Blink_image_1.1_Check_Point_R81.10_T335_SecurityGateway.tgz:has_metadata 1
Mar 25 08:33:10 2023 xxxx xpand[23012]: Configuration changed from localhost by user admin by the service dbset

Do you think the issue is:

a) Wrong proxy configuration

b) Wrong OS or multiple version of OS trying to boot/install

c) conflicting IPS version / app control

This issue still has not been resolved in jira would like to see if you have a solution verified.

-Chris

topic Re: I get a peculiar message after upgrading to R80.40. in General Topics

I get a peculiar message after upgrading to R80.40.

Re: I get a peculiar message after upgrading to R80.40.

Re: I get a peculiar message after upgrading to R80.40.

Re: I get a peculiar message after upgrading to R80.40.

Re: I get a peculiar message after upgrading to R80.40.