This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
ABOUT CHECKMATES CYBER SECURITY COMMUNITY & FAQ
Create a Post
Help
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 

Are you a member of CheckMates?

×
Sign in with your Check Point UserCenter/PartnerMap account to access more great content and get a chance to win some Apple AirPods! If you don't have an account, create one now for free!
AndiHoxha1996
Explorer
‎2025-08-14 03:10 PM

Gateways with red cross

Hello i have a issue in my smart console r81.20,all my gateways are with red cross,this happened when the primary isp finished their support and then i am connected with the backup is. The communication is trusted,but i cannot install policy rules

0 Kudos
17 Replies
_Val_
Admin
Admin
‎2025-08-15 01:09 AM

Did you try testing SIC communications? If you cannot install policy, most probably you are having connectivity issues, which also means, SIC should show an error too.

0 Kudos
AndiHoxha1996
Explorer
‎2025-08-15 01:41 AM
In response to _Val_

 Screenshot 2025-08-15 103941.pngthe sic is trusted

 

 

0 Kudos
AndiHoxha1996
Explorer
‎2025-08-15 01:42 AM
In response to _Val_

Screenshot 2025-08-15 103941.png

0 Kudos
_Val_
Admin
Admin
‎2025-08-15 03:15 AM
In response to AndiHoxha1996

What do you see when you click on "Test SIC Status" button?

0 Kudos
AndiHoxha1996
Explorer
‎2025-08-15 03:18 AM
In response to _Val_

this oneScreenshot 2025-08-15 121714.png

0 Kudos
the_rock
MVP Platinum
MVP Platinum
‎2025-08-15 06:12 AM
In response to AndiHoxha1996

Thats your answer then...sic is broken.

Andy

Best,
Andy
0 Kudos
Bob_Zimmerman
MVP Gold
MVP Gold
‎2025-08-15 07:13 AM
In response to the_rock

Strictly, that only tells us TCP connectivity is broken. The SIC certificates could still be trusted or could be broken, but the connection doesn't get that far.

the_rock
MVP Platinum
MVP Platinum
‎2025-08-15 07:16 AM
In response to Bob_Zimmerman

Im 100% sure that tells you SIC is indeed broken. If it was not, it would say communicating.

Andy

Best,
Andy
Bob_Zimmerman
MVP Gold
MVP Gold
‎2025-08-15 07:20 AM
In response to the_rock

"Could not establish TCP connection" is a lower-level failure. It's what you will get if there's a fiber cut between the management and the firewall (or a routing loop, or if one of the addresses has changed since you pushed policy, or if there's an issue in the masters file, etc.). Fix the fiber (or other underlying issue), and SIC will still work.

It's not enough information to say whether SIC is working or broken, as SIC wasn't even tested.

the_rock
MVP Platinum
MVP Platinum
‎2025-08-15 07:24 AM
In response to Bob_Zimmerman

Im fairly positive output of below would not be the same on the fw where sic is broken.

Andy

[Expert@CP-GW:0]# netstat -ant | grep 18191
tcp 0 0 0.0.0.0:18191 0.0.0.0:* LISTEN
[Expert@CP-GW:0]#

Best,
Andy
0 Kudos
AndiHoxha1996
Explorer
‎2025-08-15 07:26 AM
In response to the_rock

How can i fix,do i need to be on site physically ?

0 Kudos
the_rock
MVP Platinum
MVP Platinum
‎2025-08-15 07:39 AM
In response to AndiHoxha1996

Run command like below (from my lab) and see what it shows when you press that option to test sic status, it will give us a good idea why it fails. In my lab, mgmt is 172.16.10.252. MAKE SURE route is there and is correct...you can run on the gw ip r g mgmt_ip. Obviously, confirm its communicating back and forth, you can ping from both sides.

[Expert@CP-GW:0]# ip r g 172.16.10.252
172.16.10.252 dev eth0 src 172.16.10.249
cache
[Expert@CP-GW:0]#

 

[Expert@CP-GW:0]# fw monitor -e "accept port(18191);"
PPAK 0: Get before set operation succeeded of fwmonitor_kiss_enable
PPAK 0: Get before set operation succeeded of fwmonitor_debug_filter_off
PPAK 0: Get before set operation succeeded of fwmonitorfreebufs
************************************************************** NOTE **************************************************************
*** Using "-e" filter will not monitor accelerated traffic. To monitor and filter accelerated traffic please use the "-F" filter ***
************************************************************************************************************************************
FW monitor will record only ip & transport layers in a packet
For capturing the whole packet please do -w
PPAK 0: Get before set operation succeeded of fwmonitor_ppak_all_position
monitor: getting filter (from command line)
monitor: compiling
monitorfilter:
Compiled OK.
monitor: loading
monitor: monitoring (control-C to stop)
PPAK 0: Get before set operation succeeded of fwmonitormaxpacket
PPAK 0: Get before set operation succeeded of fwmonitormask
PPAK 0: Get before set operation succeeded of fwmonitorallocbufs
PPAK 0: Get before set operation succeeded of printuuid

 

 

 

 

 

 

[vs_0][fw_1] eth0:i[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=60 id=36507
TCP: 63837 -> 18191 .S.... seq=6e127c0e ack=00000000
[vs_0][fw_1] eth0:I[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=60 id=36507
TCP: 63837 -> 18191 .S.... seq=6e127c0e ack=00000000
[vs_0][fw_1] eth0:o[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=60 id=0
TCP: 18191 -> 63837 .S..A. seq=94a0286c ack=6e127c0f
[vs_0][fw_1] eth0:O[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=60 id=0
TCP: 18191 -> 63837 .S..A. seq=94a0286c ack=6e127c0f
[vs_0][fw_1] eth0:i[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=52 id=36508
TCP: 63837 -> 18191 ....A. seq=6e127c0f ack=94a0286d
[vs_0][fw_1] eth0:I[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=52 id=36508
TCP: 63837 -> 18191 ....A. seq=6e127c0f ack=94a0286d
[vs_0][fw_1] eth0:i[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=56 id=36509
TCP: 63837 -> 18191 ...PA. seq=6e127c0f ack=94a0286d
[vs_0][fw_1] eth0:I[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=56 id=36509
TCP: 63837 -> 18191 ...PA. seq=6e127c0f ack=94a0286d
[vs_0][fw_1] eth0:o[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=52 id=41188
TCP: 18191 -> 63837 ....A. seq=94a0286d ack=6e127c13
[vs_0][fw_1] eth0:O[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=52 id=41188
TCP: 18191 -> 63837 ....A. seq=94a0286d ack=6e127c13
[vs_0][fw_1] eth0:o[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=56 id=41189
TCP: 18191 -> 63837 ...PA. seq=94a0286d ack=6e127c13
[vs_0][fw_1] eth0:O[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=56 id=41189
TCP: 18191 -> 63837 ...PA. seq=94a0286d ack=6e127c13
[vs_0][fw_1] eth0:i[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=56 id=36510
TCP: 63837 -> 18191 ...PA. seq=6e127c13 ack=94a0286d
[vs_0][fw_1] eth0:I[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=56 id=36510
TCP: 63837 -> 18191 ...PA. seq=6e127c13 ack=94a0286d
[vs_0][fw_1] eth0:i[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=52 id=36511
TCP: 63837 -> 18191 ....A. seq=6e127c17 ack=94a02871
[vs_0][fw_1] eth0:I[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=52 id=36511
TCP: 63837 -> 18191 ....A. seq=6e127c17 ack=94a02871
[vs_0][fw_1] eth0:o[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=52 id=41190
TCP: 18191 -> 63837 ....A. seq=94a02871 ack=6e127c17
[vs_0][fw_1] eth0:O[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=52 id=41190
TCP: 18191 -> 63837 ....A. seq=94a02871 ack=6e127c17
[vs_0][fw_1] eth0:i[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=128 id=36512
TCP: 63837 -> 18191 ...PA. seq=6e127c17 ack=94a02871
[vs_0][fw_1] eth0:I[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=128 id=36512
TCP: 63837 -> 18191 ...PA. seq=6e127c17 ack=94a02871
[vs_0][fw_1] eth0:o[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=52 id=41191
TCP: 18191 -> 63837 ....A. seq=94a02871 ack=6e127c63
[vs_0][fw_1] eth0:O[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=52 id=41191
TCP: 18191 -> 63837 ....A. seq=94a02871 ack=6e127c63
[vs_0][fw_1] eth0:o[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=89 id=41192
TCP: 18191 -> 63837 ...PA. seq=94a02871 ack=6e127c63
[vs_0][fw_1] eth0:O[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=89 id=41192
TCP: 18191 -> 63837 ...PA. seq=94a02871 ack=6e127c63
[vs_0][fw_1] eth0:i[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=52 id=36513
TCP: 63837 -> 18191 ....A. seq=6e127c63 ack=94a02896
[vs_0][fw_1] eth0:I[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=52 id=36513
TCP: 63837 -> 18191 ....A. seq=6e127c63 ack=94a02896
[vs_0][fw_1] eth0:o[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=114 id=41193
TCP: 18191 -> 63837 ...PA. seq=94a02896 ack=6e127c63
[vs_0][fw_1] eth0:O[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=114 id=41193
TCP: 18191 -> 63837 ...PA. seq=94a02896 ack=6e127c63
[vs_0][fw_1] eth0:i[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=52 id=36514
TCP: 63837 -> 18191 ....A. seq=6e127c63 ack=94a028d4
[vs_0][fw_1] eth0:I[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=52 id=36514
TCP: 63837 -> 18191 ....A. seq=6e127c63 ack=94a028d4
[vs_0][fw_1] eth0:i[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=62 id=36515
TCP: 63837 -> 18191 ...PA. seq=6e127c63 ack=94a028d4
[vs_0][fw_1] eth0:I[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=62 id=36515
TCP: 63837 -> 18191 ...PA. seq=6e127c63 ack=94a028d4
[vs_0][fw_1] eth0:o[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=52 id=41194
TCP: 18191 -> 63837 ....A. seq=94a028d4 ack=6e127c6d
[vs_0][fw_1] eth0:O[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=52 id=41194
TCP: 18191 -> 63837 ....A. seq=94a028d4 ack=6e127c6d
[vs_0][fw_1] eth0:i[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=181 id=36516
TCP: 63837 -> 18191 ...PA. seq=6e127c6d ack=94a028d4
[vs_0][fw_1] eth0:I[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=181 id=36516
TCP: 63837 -> 18191 ...PA. seq=6e127c6d ack=94a028d4
[vs_0][fw_1] eth0:o[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=52 id=41195
TCP: 18191 -> 63837 ....A. seq=94a028d4 ack=6e127cee
[vs_0][fw_1] eth0:O[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=52 id=41195
TCP: 18191 -> 63837 ....A. seq=94a028d4 ack=6e127cee
[vs_0][fw_1] eth0:o[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=91 id=41196
TCP: 18191 -> 63837 ...PA. seq=94a028d4 ack=6e127cee
[vs_0][fw_1] eth0:O[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=91 id=41196
TCP: 18191 -> 63837 ...PA. seq=94a028d4 ack=6e127cee
[vs_0][fw_1] eth0:i[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=327 id=36517
TCP: 63837 -> 18191 ...PA. seq=6e127cee ack=94a028fb
[vs_0][fw_1] eth0:I[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=327 id=36517
TCP: 63837 -> 18191 ...PA. seq=6e127cee ack=94a028fb
[vs_0][fw_1] eth0:o[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=1500 id=41197
TCP: 18191 -> 63837 ....A. seq=94a028fb ack=6e127e01
[vs_0][fw_1] eth0:O[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=1500 id=41197
TCP: 18191 -> 63837 ....A. seq=94a028fb ack=6e127e01
[vs_0][fw_1] eth0:o[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=860 id=41198
TCP: 18191 -> 63837 ...PA. seq=94a02ea3 ack=6e127e01
[vs_0][fw_1] eth0:O[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=860 id=41198
TCP: 18191 -> 63837 ...PA. seq=94a02ea3 ack=6e127e01
[vs_0][fw_1] eth0:i[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=52 id=36518
TCP: 63837 -> 18191 ....A. seq=6e127e01 ack=94a031cb
[vs_0][fw_1] eth0:I[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=52 id=36518
TCP: 63837 -> 18191 ....A. seq=6e127e01 ack=94a031cb
[vs_0][fw_1] eth0:i[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=1500 id=36519
TCP: 63837 -> 18191 ....A. seq=6e127e01 ack=94a031cb
[vs_0][fw_1] eth0:I[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=1500 id=36519
TCP: 63837 -> 18191 ....A. seq=6e127e01 ack=94a031cb
[vs_0][fw_1] eth0:i[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=608 id=36520
TCP: 63837 -> 18191 ...PA. seq=6e1283a9 ack=94a031cb
[vs_0][fw_1] eth0:I[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=608 id=36520
TCP: 63837 -> 18191 ...PA. seq=6e1283a9 ack=94a031cb
[vs_0][fw_1] eth0:o[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=52 id=41199
TCP: 18191 -> 63837 ....A. seq=94a031cb ack=6e1285d5
[vs_0][fw_1] eth0:O[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=52 id=41199
TCP: 18191 -> 63837 ....A. seq=94a031cb ack=6e1285d5
[vs_0][fw_1] eth0:i[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=273 id=36521
TCP: 63837 -> 18191 ...PA. seq=6e1285d5 ack=94a031cb
[vs_0][fw_1] eth0:I[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=273 id=36521
TCP: 63837 -> 18191 ...PA. seq=6e1285d5 ack=94a031cb
[vs_0][fw_1] eth0:o[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=1171 id=41200
TCP: 18191 -> 63837 ...PA. seq=94a031cb ack=6e1286b2
[vs_0][fw_1] eth0:O[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=1171 id=41200
TCP: 18191 -> 63837 ...PA. seq=94a031cb ack=6e1286b2
[vs_0][fw_1] eth0:i[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=52 id=36522
TCP: 63837 -> 18191 ....A. seq=6e1286b2 ack=94a0362a
[vs_0][fw_1] eth0:I[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=52 id=36522
TCP: 63837 -> 18191 ....A. seq=6e1286b2 ack=94a0362a
[vs_0][fw_1] eth0:o[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=1257 id=41201
TCP: 18191 -> 63837 ...PA. seq=94a0362a ack=6e1286b2
[vs_0][fw_1] eth0:O[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=1257 id=41201
TCP: 18191 -> 63837 ...PA. seq=94a0362a ack=6e1286b2
[vs_0][fw_1] eth0:i[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=52 id=36523
TCP: 63837 -> 18191 ....A. seq=6e1286b2 ack=94a03adf
[vs_0][fw_1] eth0:I[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=52 id=36523
TCP: 63837 -> 18191 ....A. seq=6e1286b2 ack=94a03adf
[vs_0][fw_1] eth0:i[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=138 id=36524
TCP: 63837 -> 18191 ...PA. seq=6e1286b2 ack=94a03adf
[vs_0][fw_1] eth0:I[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=138 id=36524
TCP: 63837 -> 18191 ...PA. seq=6e1286b2 ack=94a03adf
[vs_0][fw_1] eth0:o[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=78 id=41202
TCP: 18191 -> 63837 ...PA. seq=94a03adf ack=6e128708
[vs_0][fw_1] eth0:O[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=78 id=41202
TCP: 18191 -> 63837 ...PA. seq=94a03adf ack=6e128708
[vs_0][fw_1] eth0:i[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=120 id=36525
TCP: 63837 -> 18191 ...PA. seq=6e128708 ack=94a03af9
[vs_0][fw_1] eth0:I[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=120 id=36525
TCP: 63837 -> 18191 ...PA. seq=6e128708 ack=94a03af9
[vs_0][fw_1] eth0:o[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=86 id=41203
TCP: 18191 -> 63837 ...PA. seq=94a03af9 ack=6e12874c
[vs_0][fw_1] eth0:O[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=86 id=41203
TCP: 18191 -> 63837 ...PA. seq=94a03af9 ack=6e12874c
[vs_0][fw_1] eth0:i[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=86 id=36526
TCP: 63837 -> 18191 ...PA. seq=6e12874c ack=94a03b1b
[vs_0][fw_1] eth0:I[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=86 id=36526
TCP: 63837 -> 18191 ...PA. seq=6e12874c ack=94a03b1b
[vs_0][fw_1] eth0:o[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=90 id=41204
TCP: 18191 -> 63837 ...PA. seq=94a03b1b ack=6e12876e
[vs_0][fw_1] eth0:O[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=90 id=41204
TCP: 18191 -> 63837 ...PA. seq=94a03b1b ack=6e12876e
[vs_0][fw_1] eth0:i[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=76 id=36527
TCP: 63837 -> 18191 F..PA. seq=6e12876e ack=94a03b1b
[vs_0][fw_1] eth0:I[44]: 172.16.10.252 -> 172.16.10.249 (TCP) len=76 id=36527
TCP: 63837 -> 18191 F..PA. seq=6e12876e ack=94a03b1b
[vs_0][fw_1] eth0:i[40]: 172.16.10.252 -> 172.16.10.249 (TCP) len=40 id=0
TCP: 63837 -> 18191 ..R... seq=6e12876e ack=00000000
[vs_0][fw_1] eth0:I[40]: 172.16.10.252 -> 172.16.10.249 (TCP) len=40 id=0
TCP: 63837 -> 18191 ..R... seq=6e12876e ack=00000000
[vs_0][fw_1] eth0:o[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=52 id=41205
TCP: 18191 -> 63837 ....A. seq=94a03b41 ack=6e128787
[vs_0][fw_1] eth0:O[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=52 id=41205
TCP: 18191 -> 63837 ....A. seq=94a03b41 ack=6e128787
[vs_0][fw_1] eth0:i[40]: 172.16.10.252 -> 172.16.10.249 (TCP) len=40 id=0
TCP: 63837 -> 18191 ..R... seq=6e128787 ack=00000000
[vs_0][fw_1] eth0:I[40]: 172.16.10.252 -> 172.16.10.249 (TCP) len=40 id=0
TCP: 63837 -> 18191 ..R... seq=6e128787 ack=00000000
[vs_0][fw_1] eth0:o[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=86 id=41206
TCP: 18191 -> 63837 F..PA. seq=94a03b41 ack=6e128787
[vs_0][fw_1] eth0:O[44]: 172.16.10.249 -> 172.16.10.252 (TCP) len=86 id=41206
TCP: 18191 -> 63837 F..PA. seq=94a03b41 ack=6e128787
[vs_0][fw_1] eth0:i[40]: 172.16.10.252 -> 172.16.10.249 (TCP) len=40 id=0
TCP: 63837 -> 18191 ..R... seq=6e128787 ack=00000000
[vs_0][fw_1] eth0:I[40]: 172.16.10.252 -> 172.16.10.249 (TCP) len=40 id=0
TCP: 63837 -> 18191 ..R... seq=6e128787 ack=00000000
^C monitor: caught sig 2
monitor: unloading
PPAK 0: Get before set operation succeeded of fwmonitor_kiss_enable
PPAK 0: Get before set operation succeeded of fwmonitor_debug_filter_off
PPAK 0: Get before set operation succeeded of fwmonitorfreebufs
[Expert@CP-GW:0]#
[Expert@CP-GW:0]#
[Expert@CP-GW:0]#

Best,
Andy
0 Kudos
AndiHoxha1996
Explorer
‎2025-08-15 07:25 AM
In response to the_rock

How can i fix,do i need to be on site physically ?

0 Kudos
the_rock
MVP Platinum
MVP Platinum
‎2025-08-15 07:27 AM
In response to AndiHoxha1996

First, see what output nof that command shows. if it fails, which Im positive it will, we need to check why its not communicating. Run tcpdump and fw monitor on that port and see where its failing.

Andy

Best,
Andy
0 Kudos
_Val_
Admin
Admin
‎2025-08-18 12:34 AM
In response to AndiHoxha1996

Did you change the IP address of your management server during the migration?

0 Kudos
HeikoAnkenbrand
MVP Platinum
MVP Platinum
‎2025-08-15 02:01 AM

Hi @AndiHoxha1996 

When troubleshooting policy installation issues, follow the guidelines from the relevant SK (sk179626 - Common Policy Installation Errors).

First, review the installation logs to identify the exact error message and affected gateway. Ensure that all policy targets are available, responsive, and running the correct software version.

Verify SIC trust between the Security Management Server and gateways, and check for any expired licenses or certificates.

If compilation errors occur, review recent policy changes for syntax issues, unsupported objects, or rule conflicts.

You can also run "fw fetch" or "fw stat" from the gateway CLI to confirm policy status and connectivity. Finally, enable higher debug levels (see SK).

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips
0 Kudos
AndiHoxha1996
Explorer
‎2025-08-15 02:40 AM
In response to HeikoAnkenbrand

i can access the gateways with cli and through web,we had two isp,one was primary and second as backup.We had configured the gateways with the primary isp IP range but they dont support us anymore and since then the gateways are with red cross but at all of them sic communication is trusted and can access them with cli and web

thank you in advance

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

View All ≫
Upcoming Events

    CheckMates Events