How to unload a specific policy in smart1 cloud to a specific site?

[Jips02]

I recently changed public ip of a gateway managed through smart 1 cloud.

I did a reset of SIC. 

I forgot to get interface topology after i resetted to sic so the policy installation to the gateway was still containing the old public ip.

push policy is still pending up until now (first image)

now i did another SIC reset and I've already updated topology but i cant push the policy due to pending policy earlier (see seecond attached image)

I already tried cpstop and cpstart on gateway

i have also tried rebooting the gateway.

[jorgeluiznim]

Hi @Jips02 ,

The important thing to keep in mind is that in Smart-1 Cloud the gateway is managed over the MaaS WebSocket tunnel, not its public IP directly  and per the Smart-1 Cloud Admin Guide, the maas tunnel interface must have the same IP as the Security Gateway object. When you changed the public IP, that alignment most likely broke, so the management can no longer reach the gateway and the install sits at "pending: IP … not available." That's why cpstop/cpstart and a reboot didn't help  the problem is the tunnel/token, not the gateway processes.

Two things worth knowing first:

• The policy-installation card in the bottom-left is not a reliable status indicator. The Admin Guide explicitly notes it shows the initial policy and is not updated with the real status on subsequent installs  so part of what you're seeing as "still pending" is a stale card.
• Please stop doing further SIC resets  per Smart-1 Cloud guidance, regenerating the token fixes this without re-establishing SIC, and repeated resets just add churn.

Step 1 — check the tunnel and the IP alignment (on the gateway):

maas status                              # Expert mode
show security-gateway cloud-mgmt-service # Gaia Clish
ifconfig                                 # confirm a "maas tunnel" interface exists

Key check: the maas tunnel interface must carry the same IP as the (new) gateway object. If it's missing or shows the old IP, that's your root cause. Connection logs are in $FWDIR/log/vtunnel and $FWDIR/log/wstunnel.

Step 2 — restart the tunnel:

maas off        # (Clish: set security-gateway cloud-mgmt-service off)
(wait ~10s)
maas on         # (Clish: set security-gateway cloud-mgmt-service on)

Step 3 — if it's still "Tunnel Down", regenerate the token (Admin Guide, Troubleshooting):

• In the Smart-1 Cloud portal: the gateway's ⋮ (three dots) > Regenerate Token, then follow the on-screen steps; on the gateway reconnect with set security-gateway cloud-mgmt-service on auth-token <TOKEN> (or maas on).
• (Equivalent from SmartConsole: double-click the gateway > Options > Reset communication.)

Step 4 — clear the stuck "already in progress" task: Smart-1 Cloud has no expert shell on the management, so you can't kill it from CLI. In SmartConsole open Manage & Settings > Tasks and try to Cancel the pending install; if it won't cancel, once the tunnel is healthy again the stuck task will time out against the old IP and release the lock. If it stays wedged after the tunnel is up, open a Cloud/TAC case (that's the only way to clear a stuck task on the cloud management).

Step 5 — re-fetch topology (Network Management > Get Interfaces With Topology, which you did) and install policy.

On your actual question — "unload the policy": fw unloadlocal on the gateway would remove the enforced policy, but it leaves the gateway allowing all traffic (security risk) and it does not clear the management-side lock, so it won't solve the "can't push" problem. I'd avoid it here fixing the tunnel + clearing the task is the right path.

References: Smart-1 Cloud Administration Guide – Troubleshooting; and the CheckMates thread "Maas tunnel down with smart-1 cloud" (maas off/on → regenerate token).

Hope this helps!

Best regards,
Jorge Dias Junior