SMB appliance internal storage

[mhmdmahdi]

Hi,

Does anyone have information about SMB appliance internal storage capacity? Especially for 1570, 1590, 1600 and. 1800.

I can’t find the information on the data sheet.

Thank you.

[Chris_Atkinson · Accepted solution]

It's listed on the 1600/1800 datasheet.

1600: 32G eMMC expandable with 32/64GB SD-card for logs.

1800: 32G eMMC + 256GB SSD expandable with 32/64GB SD-card for logs

Minimal on the lower end models but again expandable via SD-card.

Refer also:

https://community.checkpoint.com/t5/SMB-Gateways-Spark/Quantum-Spark-Storage-Capacity/m-p/125981
https://community.checkpoint.com/t5/SMB-Gateways-Spark/1590-Internal-storage/m-p/141861

[mhmdmahdi]

Thanks for the feedback.

It’s listed on the data sheet but it doesn’t mention the built-in internal storage capacity (flash memory).

Anyway, I got the answer from the link above. Thank you.

[G_W_Albrecht]

Does the 1500 also have a 32G eMMC or 16G ?

[PhoneBoy]

My 1590 appears to have 16GB eMMC.

[G_W_Albrecht]

Makes sense. So:

1500: 16G eMMC expandable with 32GB SD-card for logs.

[nordom]

On 1550 there seems to have only 4GB space which lead after 3 year of usage to performance decrease due to lack of space.

[Expert@****]# df -h
Filesystem Size Used Available Use% Mounted on
tmpfs 20.0M 14.0M 6.0M 70% /tmp
tmpfs 60.0M 21.7M 38.3M 36% /fwtmp
/dev/mmcblk1p8 623.8M 36.0M 542.3M 6% /logs
/dev/mmcblk1p11 1.2G 1.1G 56.1M 95% /storage
/dev/mmcblk1p6 692.7M 623.9M 18.4M 97% /pfrm2.0
tmpfs 20.0M 8.5M 11.5M 42% /tmp/log/local
tmpfs 500.0M 0 500.0M 0% /tetmp

[Amir_Ayalon]

Hi

4GB storage should be enough for a 4GB Appliance.

if storage is full, you can contact support to release PFRM2.0 and Storage partition.

thanks

[Us4r]

We have the same issue on all of our 1550 Devices. Every day a lot of these devices have Full storage or ar nearly on full storage. This makes a lot of problems on our environment (examples: Policy installtion failes, services crashes, IPS updates fails, dynamic objects can't be updated or the file gets corrupt during the update because of empty free space. Also TAC case is there regarding this case but no really official solution.

Because TAC Case also has no quick solution for NOW, I'm working on a script which should automatically clean up the latest IPS Profile folder and remove the last Configuration Backup - ZIP File. The pathes are:

/storage/ips/update/latest/*

/storage/<GWNAME>_<Release>_<timestamp>.zip

Also on some gateways I see on /storage a file called "revert_image.img" which consumes a lot of space on 1550 Appliances if there. I think this rever image will be created when there was a firmware upgrade.

Does anybody know if it's safe to remove this file via script, if there?

- 

[Us4r]

In the logs from yesterday I can see that the firmware upgrade of the mentioned box was successfull and "normally" a rm -rf of the revert_image.img was tried to be executed in the post process.

=> I think it's save to delete this image when it's there.

Here are the logs:

2025-Feb-05-17:42:10: Executing command: '/bin/rm -rf /storage/state_partition1/local/*'
2025-Feb-05-17:42:10: Executing command: '/bin/rm -rf /storage/state_partition1/__tmp/*'
2025-Feb-05-17:42:10: Copying current state directory to /storage/state_partition1/local
2025-Feb-05-17:42:10: Executing command: '/bin/cp -a /opt/fw1/state/local/AMW /opt/fw1/state/local/FW1 /opt/fw1/state/local/ROUTING /opt/fw1/state/local/backup /storage/state_partition1/local/'
2025-Feb-05-17:42:34: Copying temp state directory to /storage/state_partition1/__tmp
2025-Feb-05-17:42:34: Executing command: '/bin/cp -a /opt/fw1/state/__tmp/* /storage/state_partition1/__tmp/'
cp: can't stat '/opt/fw1/state/__tmp/*': No such file or directory
2025-Feb-05-17:42:34: Executing command: '/bin/rm -rf /mnt/inactive/config1/fw1/conf/no_local_logging'
2025-Feb-05-17:42:34: Upgrading the FW1 registry...
2025-Feb-05-17:42:34: Executing command: '/mnt/inactive/opt/fw1/bin/fw upgrade_registry /mnt/inactive/config1/fw1/registry/HKLM_registry.data /mnt/inactive/config1/fw1/registry/HKLM_registry.data.NEW /mnt/inactive/opt/fw1/registry/HKLM_registry.data'
2025-Feb-05-17:42:36: Executing command: '/bin/mv /mnt/inactive/config1/fw1/registry/HKLM_registry.data.NEW /mnt/inactive/config1/fw1/registry/HKLM_registry.data'
2025-Feb-05-17:42:39: Executing command: '/bin/rm -rf /pfrm2.0/config2/*'
2025-Feb-05-17:42:39: Executing command: '/bin/cp -a /pfrm2.0/config1/ace /pfrm2.0/config1/devices.db /pfrm2.0/config1/dhcpd.leases.LAN5 /pfrm2.0/config1/dhcpd.leases.LAN5~ /pfrm2.0/config1/expert_pass_ /pfrm2.0/config1/fw1 /pfrm2.0/config1/passwd /pfrm2.0/config1/restore_future_settings_hook.sh /pfrm2.0/config1/sha
2025-Feb-05-17:44:10: Executing command: '/sbin/fw_setenv bootcmd run upgrade_boot'
2025-Feb-05-17:44:10: Executing command: '/opt/fw1/bin/cp_write_syslog.sh [System Operations] Successfully upgraded the appliance software version'
2025-Feb-05-17:44:10: Executing command: '/bin/sync'
2025-Feb-05-17:44:10: Executing command: '/bin/umount /mnt/inactive'
umount: can't unmount /mnt/inactive: Device or resource busy
2025-Feb-05-17:44:10: Executing command: '/bin/rm -rf /storage/revert_image.img'
2025-Feb-05-17:44:11: Image upgrade process completed successfully.
2025-Feb-05-17:44:11: Executing command: '/pfrm2.0/bin/sqlcmd update reboot set rebootTime = '60''
2025-Feb-05-17:44:11: Executing command: '/pfrm2.0/bin/sqlcmd update reboot set reboot = '1''
2025-Feb-05-17:44:11: Executing command: '/bin/rm -rf /fwtmp/upgradeRevertInProgress'
2025-Feb-05-17:44:11: Exiting with error code 0.
2025-Feb-05-17:49:43 - upgrade_sanity_checks_interval=5
2025-Feb-05-17:49:43 - upgrade_sanity_checks_period=30
2025-Feb-05-17:49:43 - upgradeSanityChecks=mgmt_connectivity_and_policy_revert_verification
2025-Feb-05-17:49:43 - isPreUpgradePolicyNonDefault=true (relevant after upgrade)
2025-Feb-05-17:49:43 - preUpgradeConnectivityOK=true
2025-Feb-05-17:49:43 - isPreUpgradePolicyNameLocal=false
2025-Feb-05-17:49:44 - Pre-upgrade connectivity to management was OK. Now testing after upgrade
2025-Feb-05-17:49:44 - Running Connectivity Validations.
2025-Feb-05-17:49:44 - Upgrade validation. Policy installed successfully.
2025-Feb-05-17:49:44 - Upgrade validation is OK
2025-Feb-05-17:49:44: Disabling watchdog.
2025-Feb-05-17:49:44: Post-boot completed successfully.

[Juergen_Blumens]

We have the same problem. Our 1550s also run out of file space, so that functions such as IPS fail in the end. We regularly delete files, but it is not a permanent solution. TAC has not yet presented a permanent solution either.

However, we have identified an additional problem: On many of our 1550s the EMMC is near the end of life.

show diag
.....
EMMC % of device lifetime used: 100% - NOK
.....

The status is also visible with cpview. 

What does your 1550 EMMC look like?

[G_W_Albrecht]

If EMMC is at end of its lifetime you can opeb SR# with CP TAC for RMA ! SMBs work for about 5 years in average.

Space issue: Reboot does not help ?

[Juergen_Blumens]

We haven't reached the 5 years yet. And yes, we are of course opening the RMA, but it is a huge effort for us to replace all firewalls worldwide. The expectations are simply different.

We clean up the disk space and reboot, a few days later the disk space is gone again. It's a recurring problem on various 1550s in our environment. The TAC ticket has been open for months without a solution.

[ohadp]

Hi,

We have a new optimizer script available for your gateway.

Please run it using the following link:
🔗 Optimizer Script – sk183290

If you need any assistance or the script doesn’t resolve your issue,

feel free to reach out to me or open an SR with support.

Ohad

[G_W_Albrecht]

NIce - but what if i have a locally managed SMB and do require probing ? And what about SMBs managed by OnPrem SMS ?

Also i doubt that this will help much if it it shuts off SD-WAN on a SD-WAN appliance...

[ohadp]

You can run the second script (without disabling probing). While it does consume some memory, it allows you to view reports in SMP.

For centrally managed SMB devices, the following settings will not be disabled:

• IoT

• SD-WAN

• SmartAccel

• Hit Count

• Privacy Settings

If you're using SD-WAN, you can re-enable it afterward. However, if it's not in use, there's no need to keep it enabled unnecessarily.

Additionally, the script addresses partition issues and disables Satellite services for statistics collection.

[Us4r]

Hello,

nice script. At the moment we also have a TAC - Case regarding our Storage Issues opened and we are testing the new Release R81.10.17 Build 996004508. Does the optimization script bring enhancements also on this new build or are these enhancements included there?

[PhoneBoy]

I ran into an issue running this optimizer script on my Quantum Spark 1590 with R81.10.17.
Specifically, after I ran the script, Internet appeared to no longer work.
An fw ctl zdebug showed the relevant traffic being dropped by "NAT rule mismatch"
The NAT involved is "hide behind gateway" variety.

I was able to resolve my issue by deleting and re-adding the Internet connection to the device.
Hopefully the script can be updated to address this issue, but that's how I recovered from it in case anyone runs into a similar issue.

[Amir_Ayalon]

Thanks for the feedback

we are checking.

[nordom]

On my side, script was worse than the initial issue (broke client vpn connection / service) however I did receive fw1_vx_dep_R81_10_15_xxx img that solved the issue with the help of customer care and additional commands

[J_admin12]

Did you also notice that these devices were using SWAP memory over an extended period of time?
We have noticed that there were frequent SFWD crashes (10 - 40 a day), while also experiencing constant SWAP usage on 2GB 1500 Models.

[Juergen_Blumens]

We also see regular swapping, the memory is almost completely used up. According to the release notes of 81.10.17, optimizations have been made. We have installed this version on the first 1550s and will see if anything changes in terms of free diskspace and memory swapping.

[ohadp]

This script applies to R81.10.10 or R81.10.15 for 15xx gateways.

For R81.10.17, most optimizations are already built-in.

Ohad