Policy install failure

[Gary_Scott]

Has anyone ran into this error installing policy to 80.10 gateways?

FWInstallPolicyAppKernel        ERROR           cmi.c                           1486            fwk_cmi_prepare                                         cmi_                   loader: Failed to deserialize context 129. This may be caused by too many signatures applied to this context
06:53:24        2000096         InternalMsg             FWInstallPolicyAppKernel        ERROR           fwatom.c                        8364            fwk_atomic_load_prepare                                 'CMI                   ' load prepare failed
06:53:24        2000080         InternalMsg             FWInstallPolicyAppKernel        ERROR           fwk_install_policy_app.c        207             fwk_install_policy_app_load_prepare                     'fwk                   _atomic_load_prepare' failed
06:53:24        2               GuiMsg                  FW1                             ERROR           install_policy_mgr_kernel.c     860             install_policy_mgr_k_load_prepare                       Poli                   cy installation failed on gateway. If the problem persists contact Check Point support (Error code: 0-2000195).

[Joshua_Hatter]

I would recommend opening a request with support. I see one other SR with similar message. The Support Engineer was able to confirm through debugging a scenario from SK33893. 

[Gary_Scott]

A reboot of the gateway allowed for the policy install to be successful. Would still love to know what is the possible cause for Error code: 0-2000195. 

[Peter_Sithole]

Restart of the gateway and push the policy again will resolve Error code:0-2000195

[Ilya_Yusupov]

hi @Gary_Scott ,

It looks like memory issue, you can check under cpview history if you have any SMEM failuers under ==> Advanced ==> memory ==> SMEM failures.

Thanks,

Ilya 

[Benoit_Verove]

I have exactly the same error on a member of a cluster (R80.10). I'll try to debug before rebooting. I will post the results of my investigation.

Any idea is welcome.

Regards,

Benoit

[Benoit_Verove]

My customer has finally rebooted his gateway. It solved the installation failure.

Regards

[the_rock]

I saw this issue with one customer and the way we fixed it was by changing connection settings from 25000 to automatic on cluster properties. Not sure why that fixed the problem, as when we ran fw tab -t connections -s, it showed peak of 17000, but somehow chancing that option worked. TAC was never able to give client a good reason for this, but we never really pursued it much, since the problem got solved. Still, it would be nice to know the reason...

[Benoit_Verove]

Hi,

The issue occurred one more time.

This time, I had time to investigate.

In my case, the gateway is a 12600 appliance. It was handling more than 120 000 connections in R80.10 with latest jumbo.Blades used: FW, AppC, VPN, URLF, AV, AB.

Management on a VM.

The appliance simply needed more memory. The defaultt 6 GB were not enought and the appliance was swapping

Adding 6 x 1GB RAM solved the policy installation failure... so far.

Regards,

Benoit

[zekiesenalp]

I had same problem with the R80.30 CP5800 gateway with 80.40 management.  Restarting solved the problem

[Ilya_Yusupov]

Hi @zekiesenalp ,

can you please check if you had any SMEM failures under cpview history?

Thanks,

Ilya 

[Lijo_mathai]

Hi, Yes i found SMEM failures under my cpview history. Can i understand what this failure means and how to rectify this.

[Ilya_Yusupov]

I will take it offline with you

Thanks,

Ilya 

[Lijo_mathai]

Hi, I managed to solve the issue. Actually it was the CCP which was causing the cluster interface to show as down and due to which the standby box in clusterXL also went down. When i did the necessary config on the switches the interface came back to normal. Thanks

[Lijo_mathai]

I am too facing the same issue. Is there a way to find the cause of this error?