Cannot open SmartDashboard via SmartConsole but FwPolicy.exe works normally

[kamilazat]

Hi everyone!

We have a weird issue on R81.20 JHF Take 105 with Management HA setup.

Everything works on SmartConsole, we can login, make changes to objects and policies, install policy on gateways etc. but we get the error below when we attempt to connect to SmartDashboard by going to Manage&Settings > Blades and click on any "Configure in SmartDashboard" there.

The connection to Security Management Server 'hostname' has been refused because the database could not be opened.

Interestingly, when we go to the Check Point directory and run it via FwPolicy.exe we can open SmartDashboard without issues and make changes. 

We have tried making arbitrary changes on FwPolicy.exe and installing policy, synchronizing the management servers, installing databases and policies. Nothing helped so far. 

Honestly, it's confusing that we can open it via FwPolicy.exe but not via SmartConsole. CP Copliot says that it may be due to some ICA problem, but I think we wouldn't even be able to login to SmartConsole if that were the case.

Any and all ideas are more than welcome, as always :))

Cheers! 

[the_rock]

I have some questions:

1) Does this happen on just one PC or multiple?

2) If its one, did you try reinstalling smart console?

3) If multiple, did you check if there is gui update? ie new smart console build

4) What does api status show?

Andy

[kamilazat]

Hi Andy,

Let me answer your questions.

1. It happens on all 3 computers we tried.

2. We did reinstall the latest version of SC.

3. All updated.

4. api status:

API seems to be OK. 

One thing though. This is a VM with following specs:

4 CPU

32GB memory with ~14GB utilized (available ~16GB)

AND this:

/dev/mapper/vg_log-lv_log xfs 1000G 848G 153G 85% /var/log

I'm thinking that maybe something is not sufficient here. 

[G_W_Albrecht]

Put FwPolicy.exe in your Task Bar - or open SR# with CP. 

[the_rock]

Hm, so api status if fine, but wondering if /var/log % could be an issue,though seems like lots of space left. Did you attempt cprestart or mgmt reboot to see if that helps?

Andy

[Hugo_vd_Kooij]

I am more curious about the OS of the client. (CPu, disk, meory, version, ...)

And are you running the latest client version? 

[the_rock]

Good point Hugo.

Andy

[kamilazat]

That is/was a good point as @the_rock also said, until we learned that all 6 PCs that are used for connecting are having the exact same problem. All of those machines have the latest SC and have more than enough resources. 

I started thinking that it may be an SMS problem, as the secondary server has everything working perfectly  when we make it active, but the primary server keeps 'refusing' the connection. 

Maybe it's a corrupted certificate problem?

[the_rock]

It could be...did you try cprestart or rebooting it?

Andy

[kamilazat]

Exactly! We're waiting for the MW confirmation. But I'm completely lost if that also doesn't help. 

Weird that the whole thing seems to have started after the update to JHF 105 and SC update. I know that sometimes some files get corrupted or are not loaded after the automatic reboot during update. Hopefully that will help.

[the_rock]

TAC case probably would not hurt either, sounds like this would need more in-depth checks.

Andy