Hello,
Machine: MacOS
Smart Console accessed via Browser: https://private-ip/smartconsole
P12 certificate is delivered to gateways (confirmed by file timestamp matching fwm.elg push time).
SIC trust establishes ("SIC has successfully been established" in CME log).
But Install Policy always fails: "SIC General Failure [SIC error no. 325]"
cprid_util returns NULL BUF despite P12 on gateway and cpd restarted.
Resource details:
- Management: i-049317431c69b7015 / 10.0.2.155 (R82.10-PAYG, private subnet)
- Gateway A: i-0d73aecbba3a998ad / 10.0.3.6 (R82.10-PAYG-NGTP, c6in.xlarge)
- Gateway B: i-078cc9e1b64f1c34e / 10.0.3.22 (R82.10-PAYG-NGTP, c6in.xlarge)
- SIC key: LeFWexKcPbtZO1zR
CME configured with autoprov_cfg, using x-chkp-ip-address tag for private IPs.
Logs available: fwm.elg, cpd.elg, cme.log
Instances have been retained if you need them for investigation.
==========================================
1. fwm.elg log
[Expert@mgmt-aws:0]# grep "p12" $FWDIR/log/fwm.elg | tail -50
[FWM 46310]@mgmt-aws[26 Mar 17:49:35] fwca_client_push_p12_cb: trying to send p12 to entity. IP is 3.225.56.84
[FWM 46310]@mgmt-aws[26 Mar 17:51:28] fwca_client_push_p12_cb: trying to send p12 to entity. IP is 3.225.56.84
[FWM 46310]@mgmt-aws[26 Mar 17:51:49] fwca_client_push_p12_cb: trying to send p12 to entity. IP is 34.235.246.180
[FWM 46310]@mgmt-aws[26 Mar 18:02:46] fwca_client_push_p12_cb: trying to send p12 to entity. IP is 10.0.3.4
[FWM 46310]@mgmt-aws[26 Mar 18:02:58] fwca_client_push_p12_cb: trying to send p12 to entity. IP is 10.0.3.22
[FWM 46310]@mgmt-aws[26 Mar 19:59:09] fwca_client_push_p12_cb: trying to send p12 to entity. IP is 10.0.3.6
[FWM 46310]@mgmt-aws[26 Mar 20:01:00] fwca_client_push_p12_cb: trying to send p12 to entity. IP is 10.0.3.6
[FWM 46310]@mgmt-aws[26 Mar 20:01:21] fwca_client_push_p12_cb: trying to send p12 to entity. IP is 10.0.3.22
==========================================
2. cpd.elg log
[Expert@mgmt-aws:0]# tail -30 $CPDIR/log/cpd.elg
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:32:14] cpsic_reload_crl_cb: Received message mgmt_crl_reload
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:32:14] cpsic_reload_crl_cb: Got message of crl reload
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:32:14] Reloaded crl
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:32:27] cpsic_reload_crl_cb: Received message mgmt_crl_reload
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:32:27] cpsic_reload_crl_cb: Got message of crl reload
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:32:27] Reloaded crl
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:33:12] cpsic_reload_crl_cb: Received message mgmt_crl_reload
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:33:12] cpsic_reload_crl_cb: Got message of crl reload
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:33:12] Reloaded crl
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:33:25] cpsic_reload_crl_cb: Received message mgmt_crl_reload
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:33:25] cpsic_reload_crl_cb: Got message of crl reload
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:33:25] Reloaded crl
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:34:09] cpsic_reload_crl_cb: Received message mgmt_crl_reload
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:34:09] cpsic_reload_crl_cb: Got message of crl reload
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:34:09] Reloaded crl
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:34:22] cpsic_reload_crl_cb: Received message mgmt_crl_reload
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:34:22] cpsic_reload_crl_cb: Got message of crl reload
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:34:22] Reloaded crl
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:35:07] cpsic_reload_crl_cb: Received message mgmt_crl_reload
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:35:07] cpsic_reload_crl_cb: Got message of crl reload
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:35:07] Reloaded crl
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:35:20] cpsic_reload_crl_cb: Received message mgmt_crl_reload
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:35:20] cpsic_reload_crl_cb: Got message of crl reload
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:35:20] Reloaded crl
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:36:07] cpsic_reload_crl_cb: Received message mgmt_crl_reload
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:36:07] cpsic_reload_crl_cb: Got message of crl reload
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:36:07] Reloaded crl
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:36:20] cpsic_reload_crl_cb: Received message mgmt_crl_reload
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:36:20] cpsic_reload_crl_cb: Got message of crl reload
[CPD 46241 4144166912]@mgmt-aws[26 Mar 20:36:20] Reloaded crl
==========================================
3. cme.elg log
[Expert@mgmt-aws:0]# tail -n50 /var/log/CPcme/cme.log
2026-03-26 20:33:57,627 CME_SERVICE INFO The gateways found in controller hallmark-aws are:
2026-03-26 20:33:57,627 CME_SERVICE INFO 1: hallmark-aws--i-0d73aecbba3a998ad--us-east-1
2026-03-26 20:33:57,627 CME_SERVICE INFO 2: hallmark-aws--i-078cc9e1b64f1c34e--us-east-1
2026-03-26 20:33:57,628 CME_SERVICE INFO Configuration was not complete
2026-03-26 20:33:57,628 CME_SERVICE INFO hallmark-aws--i-0d73aecbba3a998ad--us-east-1 state is changed to: UPDATING
2026-03-26 20:33:57,628 CME_SERVICE INFO SIC has successfully been established between management mgmt-aws and gateway instance hallmark-aws--i-0d73aecbba3a998ad--us-east-1
2026-03-26 20:33:57,629 CME_SERVICE INFO Resetting gateway hallmark-aws--i-0d73aecbba3a998ad--us-east-1
2026-03-26 20:33:57,704 CME_SERVICE INFO Deleting objects for gateway: hallmark-aws--i-0d73aecbba3a998ad--us-east-1
2026-03-26 20:33:57,704 CME_SERVICE INFO Deleting objects with Policy Destructor AWS Automatic Policy
2026-03-26 20:33:58,241 CME_SERVICE INFO Identity Awareness software blade was successfully unset
2026-03-26 20:33:58,343 CME_SERVICE INFO HTTPS Inspection was successfully unset
2026-03-26 20:33:58,343 CME_SERVICE INFO Gateway hallmark-aws--i-0d73aecbba3a998ad--us-east-1 is not part of a scale set.
2026-03-26 20:34:02,822 CME_SERVICE INFO Setting policy Standard on gateway hallmark-aws--i-0d73aecbba3a998ad--us-east-1
2026-03-26 20:34:11,111 CME_SERVICE INFO Resetting gateway hallmark-aws--i-0d73aecbba3a998ad--us-east-1
2026-03-26 20:34:11,158 CME_SERVICE INFO Deleting objects for gateway: hallmark-aws--i-0d73aecbba3a998ad--us-east-1
2026-03-26 20:34:11,158 CME_SERVICE INFO Deleting objects with Policy Destructor AWS Automatic Policy
2026-03-26 20:34:11,173 CME_SERVICE ERROR Failed to provision the gateway instance hallmark-aws--i-0d73aecbba3a998ad--us-east-1.
Error details: Management API failure (install-policy)..
2026-03-26 20:34:11,179 CME_SERVICE ERROR Error traceback: Traceback (most recent call last):
File "/opt/CPcme/service/cme_service.py", line 595, in scale_out
is_setup_gw_succeed = management.autoprovision_handler.set_gateway(instance, gw, auto_hf)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/CPcme/cp_handlers/mgmt_autoprovision_handler.py", line 1816, in set_gateway
self.provision_gateway(instance, gw, auto_hf, gw_tags, simple_gateway)
File "/opt/CPcme/cp_handlers/mgmt_autoprovision_handler.py", line 3399, in provision_gateway
self.set_policy(gw, gw_tags.get('policy'), group_name)
File "/opt/CPcme/cp_handlers/mgmt_autoprovision_handler.py", line 337, in set_policy
install_policy_handler.invoke_install_policy(gw_name, policy)
File "/opt/CPcme/cp_handlers/mgmt_autoprovision_handler.py", line 133, in invoke_install_policy
self.management(CPMCommand.INSTALL_POLICY, {POLICY_PACKAGE: policy, TARGETS: gw_name,
File "/opt/CPcme/cp_handlers/mgmt_handler.py", line 193, in __call__
return self.client(command=command, body=body, version=version,
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/CPcme/cp_handlers/mgmt_api_handler.py", line 241, in __call__
raise ManagementApiException(
cme_exceptions.cme_exceptions.ManagementApiException: Error Code: Management API error
API call failed with command: install-policy
Payload: {'policy-package': 'Standard', 'targets': 'hallmark-aws--i-0d73aecbba3a998ad--us-east-1', 'allow-task-separation': True}
Error details: Installation failed. Reason: SIC General Failure [ SIC error no. 325 ].
2026-03-26 20:34:11,180 CME_SERVICE INFO Configuration was not complete
2026-03-26 20:34:11,181 CME_SERVICE INFO hallmark-aws--i-078cc9e1b64f1c34e--us-east-1 state is changed to: UPDATING
2026-03-26 20:34:11,181 CME_SERVICE INFO SIC has successfully been established between management mgmt-aws and gateway instance hallmark-aws--i-078cc9e1b64f1c34e--us-east-1
2026-03-26 20:34:11,181 CME_SERVICE INFO Resetting gateway hallmark-aws--i-078cc9e1b64f1c34e--us-east-1
2026-03-26 20:34:11,219 CME_SERVICE INFO Deleting objects for gateway: hallmark-aws--i-078cc9e1b64f1c34e--us-east-1
2026-03-26 20:34:11,219 CME_SERVICE INFO Deleting objects with Policy Destructor AWS Automatic Policy
2026-03-26 20:34:11,688 CME_SERVICE INFO Identity Awareness software blade was successfully unset
2026-03-26 20:34:11,787 CME_SERVICE INFO HTTPS Inspection was successfully unset
2026-03-26 20:34:11,787 CME_SERVICE INFO Gateway hallmark-aws--i-078cc9e1b64f1c34e--us-east-1 is not part of a scale set.
2026-03-26 20:34:16,195 CME_SERVICE INFO Setting policy Standard on gateway hallmark-aws--i-078cc9e1b64f1c34e--us-east-1
Any advise and guidance would be greatly appreciated
