internal error occurred during the verification process

[nflnetwork29]

Hello we have R81.10 MDS w/ R81.10 Security VE Gateway 

This is a fresh VE gateway deployment with Take 30 installed (latest) 

Have not been able to ever install any policy , i have establish SIC trust and then I am stuck . 

How can I fix this? Seems like a bug maybe as the policy I am trying to deploy is very minimal. 

I am not even trying to deploy any threat policy at this time . 

[the_rock]

What do you see if you only do policy verification?

Andy

[nflnetwork29]

yes of course, done that!  and it is successful . no issue reported there . 

[PhoneBoy]

Did you try: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

[nflnetwork29]

on my gateway

# ls -lh connectra_rulenums.html

ls: cannot access connectra_rulenums.html: No such file or directory

[the_rock]

If you run this command from expert mode-> find / -name connectra_rulenums.html

Do you see anything?

By the way, its on management(also R81.10), NOT gateway

From my lab:

[Expert@MANAGEMENT:0]# find / -name connectra_rulenums.html
find: /proc/27779: No such file or directory
find: /proc/28071: No such file or directory
find: /proc/28073: No such file or directory
/var/log/opt/CPsuite-R81/fw1/log/connectra_rulenums.html
[Expert@MANAGEMENT:0]#

Andy

[nflnetwork29]

OK yes i found it 

/var/log/mds_logs/MGMT-MDS-01/log/connectra_rulenums.html

[the_rock]

Great! Just back it up and try the sk @PhoneBoy suggested. let us know if it works.

Andy

[nflnetwork29]

to confirm .

i just replace step 1 with the path below?? 

/var/log/mds_logs/MGMT-MDS-01/log/connectra_rulenums.html

1. # cd $FWDIR/log/ >>>>>> REPLACE  THIS
2. # ls -lh connectra_rulenums.html (this will show the incorrect link)
3. # unlink connectra_rulenums.html
4. # touch connectra_rulenums.html
5. # chmod 777 connectra_rulenums.html

[the_rock]

What I would personally do, just to be safe, make backup first...so cd $FWDIR/log, then cp connectra_rulenums.html connectra_rulenums.html.backup and maybe get backup file off the server (JUST IN CASE) and then follow the instructions. I dont want to sound difficult now, but I would also take a backup as well.

[nflnetwork29]

tried the solution in the sk and still getting the same error . *sigh*

[the_rock]

Thats unfortunate. O well...I would certainly contact TAC next. In the meantime, try from mgmt ssh something like below, just replace firewall name and correct policy )below is example from my lab)

mgmt_cli install-policy policy-package "R81.10_policy" targets "gateway"

Andy

[nflnetwork29]

Should the file "connectra_rulenums.html" exist in every single CMA when referring to an MDS?

my policy name = "standard" 

when i run the cmdlt i got 

code: "generic_err_object_not_found"
message: "Requested object [standard] not found"

[the_rock]

That Im not 100% sure, you may wish to confirm with TAC on it.

Andy

[nflnetwork29]

@the_rock 

mgmt_cli install-policy policy-package "standard" targets "CORP-cp01"

[the_rock]

Can you paste exact command you ran?

[Chris_Atkinson]

Have you tried forcing a non accelerated policy install or patching with JHF T45?

[nflnetwork29]

hi @Chris_Atkinson 

yes i patched to JHF T45 . same issue . 

How do i force a non  accelerated  policy install ? i can try that 

[the_rock]

https://www.youtube.com/watch?v=saM4vueYBo8

[nflnetwork29]

@the_rock 

was worth a shot . still failed though! arggg .

[the_rock]

Sorry to say, but I got nothing else... : - (. I guess doing debug would be next step...

[nflnetwork29 · Accepted solution]

this issue was solved by TAC eventually. 

the very short answer was that basically what we had to do what remove the gateway object and re-add it .