Policy installation failed on gateway - (Error code: 2000235)

[Hitesh_Brahmbha]

Error Message on Policy Installation in Smartconsole: "Policy installation failed on gateway. If the problem persists contact Check Point support (Error code: 2000235)."

Error Message in cpd.elg - "Installation failed. Reason: Load on Module failed - failed to load security policy"

Resolution: If LSMenabler is in on state on security gateway, it will not allow to install policy and generate the above error message in the SmartConsole.

Off LSMenabler using below commands in expert mode:

Usage: LSMenabler [-d] [-r [-DynObj=<central|local>]] <off|on> [-y/-n]

if central is enabled, perform below command to off the central LSMenabler

e.g. LSMenabler -d -r -DynObj=central off -y 

if local is enabled, perform below command to off the local LSMenabler

e.g. LSMenabler -d -r -DynObj=local off -y 

[PhoneBoy]

I’m assuming this is something you ran into?
Makes sense a traditional policy install would fail since when you use LSM the policy installation process is different.

[Ilya_Semen]

Hi Hitesh !

We encountered a similar problem after activating LSMenabler.

After activation  LSMenabler -r on  ClusterXL was loss "HA module not started"  and  have error  Instal Policy "Error code: 2000235".  Unfortunately, but  we have not found comprehensive information describing this issue.

[Tal_Paz-Fridman]

Why did you run LSMenabler -r on? Is it going to be part of a SmartLSM Cluster? 

[Ilya_Semen]

We followed the official guide b it states that to activate SmartProvisioning, the following steps must be performed: 

A  Activation SmartProvisioning on SMS

B Activation SmartProvisionibg on Security Gateway 

1. From the CLI, run these commands in Expert mode:

   LSMenabler -r on

   cpstop

   cpstart

2. Run cpconfig

3. Go to the ROBO Interfaces page and define an External interface.

After executing point B, the ClusterXL was destroyed, and the installation of policies became impossible. I have a question, whether the implementation of point B is necessary on all Security Gateways or only on those that should be in SmartLSM Security Gateway  mode, but not CO ?

[Ilya_Semen · Accepted solution]

I think we've found what the issue  is: we used the wrong SmartLSM activation procedure on Security Gateways as CO(Corporate Office).  

Correct procedure is: LSMenabler on 

ClusterXL is works, Policy installed successfully. 

Tnx

[the_rock]

Awesome work! 👍

[the_rock]

Sadly, those errors can be super generic and most of the time takes few troubleshooting steps (at least) to figure out whats going on.

Andy

[Ilya_Semen]

Thank you ! what other information would be useful to solve this problem?