Policy installation failed on gateway. (Error code: 0-2000031). R80.40

[Akos_Slyuch]

Hi All,

We are using   R80.40 Take 91 on the management server , R80.30 Take  196 and R80.40  Take 93 on our security gateways

Since Monday we are experienceing problems trying to install policy on any of our gateways. The error message is the following:

Gateway: <cluster name >
Policy: <Policy package name>
Status: Failed
- Policy installation failed on gateway. If the problem persists contact Check Point support (Error code: 0-2000031).
--------------------------------------------------------------------------------

Has anybody experienced anything like this before ?

Any suggestions are welcome and appreciated !

[the_rock]

I had seen people post on this before, maybe best contact TAC and see if they can help out. Im really sorry, but cant recall now what the actual fix was...: (

[Akos_Slyuch]

I have contacted TAC but no luck 😞

[Kaspars_Zibarts]

Always an option to update MGMT to the latest JHF. As TAC often enough will encourage that first...

[the_rock]

Yea, definitely valid point : )

[the_rock]

One thing I would personally do is try do fwd and/or fwm debug while pushing the policy and then check /elg files in $FWDIR/log directory (fwd.elg and fwm.elg(

[Ilya_Yusupov]

Hi @Akos_Slyuch ,

can you please check on GW side under cpview ==> Advanced ==> Memory ==> SMEM failures, if you had any failures during the policy push process?

Thansk,

Ilya 

[Akos_Slyuch]

Hi Ilya,

We have checked it and no SMEM failures occured.

[Tal_Paz-Fridman]

Hi,

Is there any chance the Security Gateway was enabled as a SmartLSM (ROBO) Gateway?

Thanks

Tal

[Akos_Slyuch]

No , we don't have this

[Lari_Luoma]

This error message is related to 'atomic download" in the gateway. What is the memory utilization of the gateways? Is there some DDOS or similar going on that could cause the load to be so high that the gateway can't install the policy?

Open SR for further troubleshooting?

[Akos_Slyuch]

Hi,

The problem was caused by a deleted Checkpoint cluster object and the temporary solution was to revert to the revision before the deletion. It seems if we delete this object the policy installation is not possible anymore. TAC is trying to reproduce the issue in their LAB.

[the_rock]

Wow, cant say I ever seen that scenario in all my years working with CP stuff. So, if object was removed from dashboard and gobe from guidbedit, not sure what would have caused the issue...odd.