topic Re: 1430 random crash with SecureXL enabled in Spark Firewall (SMB)

1430 random crash with SecureXL enabled

KikoLlanos — Fri, 12 Mar 2021 23:29:22 GMT

Hello, good evening.

I have been detecting random appliance crashes for some time. If I disable securexl acceleration (fwaccel off command) the appliance is completely stable, but with securexl, it randomly crashes.

<1>[ 3771.640614] Unable to handle kernel NULL pointer dereference at virtual address 00000004

<1>[ 3771.648687] pgd = 80003000

<4>[ 94.038442] ######## wdt sysfs stop cmd

<1>[ 3771.651387] [00000004] *pgd=80000000004003, *pmd=00000000

<0>[ 3771.655305] Internal error: Oops: 207 [#1] SMP ARM

I have version R77.20.87 (990173083)

I hope you can help me.... I would be sad to have to change this appliance on my homelab 😞 Attached the last panic. Thank you and best regards

Re: 1430 random crash with SecureXL enabled

the_rock — Sat, 13 Mar 2021 00:28:42 GMT

I wish I could give you a good suggestion, but reading some forums online about similar errors, seems like it could be something with one of the drivers on the appliance itself. Did issue ever happen before version 87?

Andy

Re: 1430 random crash with SecureXL enabled

PhoneBoy — Sat, 13 Mar 2021 04:06:14 GMT

If disabling SecureXL solves an issue, a TAC case is definitely in order.

Re: 1430 random crash with SecureXL enabled

KikoLlanos — Sat, 13 Mar 2021 08:35:59 GMT

Hi Andy.

This is happening since i have this appliance, months ago. I dont remember the starting version

Best regards

Re: 1430 random crash with SecureXL enabled

KikoLlanos — Sat, 13 Mar 2021 08:45:15 GMT

Hi PhoneBoy

TAC case is not an option... Im using this appliance in my house because is a gift from a trainning that i received. I think license is expired.

I hope an engineer can check these logs and give me some more information.... If not, I'm afraid I'll have to replace my beloved Checkpoint with some other solution 😞

Thank you

Re: 1430 random crash with SecureXL enabled

the_rock — Sat, 13 Mar 2021 09:53:37 GMT

I will do my best to help you. Let me do some more research and see what we can try.

Andy

Re: 1430 random crash with SecureXL enabled

the_rock — Sat, 13 Mar 2021 11:12:42 GMT

Check out below:

https://unix.stackexchange.com/questions/21335/how-do-i-cause-a-watchdog-reset-of-my-embedded-linux-device

By the way, what happens if the box is rebooted with sxl enabled? Same problem?

Andy

Re: 1430 random crash with SecureXL enabled

HristoGrigorov — Sun, 14 Mar 2021 05:20:53 GMT

Take backup, reset the appliance and see if it is doing it with default settings as well.

Re: 1430 random crash with SecureXL enabled

G_W_Albrecht — Sun, 14 Mar 2021 09:14:25 GMT

You should clearly see what blades are expired in WebGUI. So currently you are using only the FW part of the SMB? Without IPS, AV, ABOT and URLF it maybe beloved but is crippled to the bone ! You could replace it with a Raspi and linux sw FW, not loosing any functionality. Why not extend the license and buy support for it ? Then you also could use NGTP services (which do not work with expired services) and get help from TAC - an engineer can check these logs and give you a fixed firmware.

But first attempt would be a reinstall from USB, flashing both backup and active firmware - current R77.20.87 version is very stable according to my experience.

Re: 1430 random crash with SecureXL enabled

KikoLlanos — Sun, 14 Mar 2021 09:09:58 GMT

I will try, but the problem i think is something in the kernel

Re: 1430 random crash with SecureXL enabled

G_W_Albrecht — Sun, 14 Mar 2021 09:10:47 GMT

What do you intend with providing that link to watchdog reset ? SMBs have no /dev/watchdog 8)

Re: 1430 random crash with SecureXL enabled

KikoLlanos — Sun, 14 Mar 2021 09:11:06 GMT

Hi Andy. Yes, appliance restart randomly with securexl enabled

Re: 1430 random crash with SecureXL enabled

KikoLlanos — Sun, 14 Mar 2021 09:16:11 GMT

Hi.

Yes, the other option is change to pfSense or openwrt. The problem is i will lose 6+1 lan ports hehe.

License is expensive, this is a homelab, not an enterprise.

Meanwhile im looking for alternatives

Re: 1430 random crash with SecureXL enabled

G_W_Albrecht — Sun, 14 Mar 2021 09:27:02 GMT

As i said before - if you are only using the FW blade, this is not worth the $377 (or so) for a years license, but if you protect your complete home (including wife and kids devices), IPS, AV, ABOT and URLF make much sense and are well worth the price.

But first attempt to resolve it would be a reinstall from USB, flashing both backup and active firmware, as current R77.20.87 version is very stable according to my experience. Maybe a bad block on flash does play you these tricks, and that will be over after flashing it, as formatting reallocated any bad blocks...

Re: 1430 random crash with SecureXL enabled

HristoGrigorov — Sun, 14 Mar 2021 12:27:56 GMT

If you gain enough evidence it is not device but firmware related issue then I think CheckPoint R&D will likely take a look at it even without support contract. But I second current firmware is very stable so it is very likely to be corruption somewhere on the device itself.

Re: 1430 random crash with SecureXL enabled

the_rock — Sun, 14 Mar 2021 12:30:57 GMT

All valid points...but, I really think the best way for him to know 100% if its blade related or not is slowly try remove blade by blade and observe the behavior. We all know those 1000 series appliances are not nearly as powerful having multiple blades enabled as some higher models...or, as you suggested before, do factory reset and see what happens.

Andy

Re: 1430 random crash with SecureXL enabled

G_W_Albrecht — Sun, 14 Mar 2021 17:28:30 GMT

True, i would suggest the same - but if the license is expired, he will have only the FW, IA, Advanced Networking and VPN blade left, and the blades disabling procedure is done with service blades 8).

Re: 1430 random crash with SecureXL enabled

the_rock — Sun, 14 Mar 2021 17:33:13 GMT

Or, if he is lucky enough, maybe someone from R&D will see this thread and decide to investigate more. Though, in my personal experience, CP is known literally not to put any effort into officially unsupported or non-licensed versions/devices. Thats very unfortunate, because Cisco TAC for example spend few times with me on the phone couple of hours at least helping with non supported versions. But, thats for another thread : )

Re: 1430 random crash with SecureXL enabled

G_W_Albrecht — Sun, 14 Mar 2021 19:57:47 GMT

Non supported versions do not hinder support from CP TAC - only if you have bought no license and support. If you get a Cisco device as a gift, without license or support, i can not imagine Cisco TAC will spend hours on the phone with you 8). There have been firmware version for 7xx/14xx that rebooted autonomously some times every week, but i did not see that for the used version. So i rather would suggest to flash from USB.

But if it is true that no SecureXL makes it stable, you could switch it off using userScript.

Re: 1430 random crash with SecureXL enabled

the_rock — Sun, 14 Mar 2021 20:48:00 GMT

I once spent 6 hours on phone with Cisco TAC for device that did NOT have support or license and guy literally did not want to get off the phone till we fixed the issue...I never ever heard example of something like that with CP TAC, but anyway :). Back to the subject...lets see if Kiko is willing to factory reset or try remove certain blades and let us know if the issue is still there.

Andy