R65 SIC General Failure error no. 148

[daz306td]

Guys/Gals,

We are experiencing intermittent SIC general failure messages when attempting to push a policy to our R65 firewalls.

Installation failed. Reason: SIC General Failure [ SIC error no. 148 ]. ( message from member BRM-GATEWAY01 )

The error seems to have no pattern to which it appears - it can appear on either of our firewalls (using clusterxl - HA mode) and if left for about an hour or so you can attempt to push the policy again and it works fine.
What I have verified is that the management box can ping all interfaces on both firewalls at the time the SIC error appears (which leads me to believe its application level). Searching round on CPUG I dropped on this topic...Perfect & Stable Hardware for R65 which suggested a CPU error with Dell hardware causing the problem, however CPU usage is nothing more than normal. I'm just wondering if anyone knows of why this could be occurring or any known fixes (apart from having to constantly reset the SIC) ??

What is interesting is that if I run 'cpinfo' from the node which is reporting the SIC failure it reports

Failed to establish session with AMON server at 127.0.0.1:18192

Any suggestions? (cphaprob list shows all states as ok)

[cciesec2006]

Originally Posted by daz306td

Guys/Gals,

We are experiencing intermittent SIC general failure messages when attempting to push a policy to our R65 firewalls.



The error seems to have no pattern to which it appears - it can appear on either of our firewalls (using clusterxl - HA mode) and if left for about an hour or so you can attempt to push the policy again and it works fine.
What I have verified is that the management box can ping all interfaces on both firewalls at the time the SIC error appears (which leads me to believe its application level). Searching round on CPUG I dropped on this topic...Perfect & Stable Hardware for R65 which suggested a CPU error with Dell hardware causing the problem, however CPU usage is nothing more than normal. I'm just wondering if anyone knows of why this could be occurring or any known fixes (apart from having to constantly reset the SIC) ??

What is interesting is that if I run 'cpinfo' from the node which is reporting the SIC failure it reports



Any suggestions? (cphaprob list shows all states as ok)

Are you using Secureplatform NGx R65 2.6 kernel? This is a KNOWN issue.

[Thorpuse]

Originally Posted by cciesec2006

Are you using Secureplatform NGx R65 2.6 kernel? This is a KNOWN issue.

Is there a hotfix or an SK for this? I think I'm seeing this with one of my customers too on SPLAT2.6.

[cciesec2006]

I experienced this on Dell 2950-III and Sun X4200-M2 platforms because
these platforms only support Secureplatform 2.6 kernel. Meplia also
experienced the same issue. He opened a TAC case with Checkpoint
but CP did not believe him.

I also opened a TAC case with CP on this but it is going nowhere.
I decided to go with IBM x3650 instead because it works with Secureplatform
2.4 kernel. TAC case has been opened for almost 5 months now.

[daz306td]

I certainly am !

Linux HOSTNAME 2.6.18-22cp #1 SMP Tue Oct 2 15:01:11 IST 2007 i686 i686 i386 GNU/Linux

Any known fixes to this known issue?

[daz306td]

Originally Posted by cciesec2006

I experienced this on Dell 2950-III

same hardware too !

[cciesec2006]

Originally Posted by daz306td

same hardware too !

I think you should send an email to Moses at Checkpoint. His email is
moses@us.checkpoint.com

Moses is the Escalation Manager in the Diamond Support team.

Tell him that Secureplatform 2.6 kernel SUCKS. It is a piece of crap.
Checkpoint should have NEVER released this crap in a condition like this.

And ask for fix at the same time.

[daz306td]

Thanks cciesec2006 it happened again today

I would like to hear from anyone else with this same issue.... see if there is any other resolution - I'll be emailing Moses however.

[l0wkey]

Just got this tonight to, R65 2.6 as well, the odd thing was the device showed down in monitor, but was passing traffic and logs and a fw ctl psstat showed no cluster errors however policy push would fail with the SIC error 148. A cpstop / cpstart resulting in nothing and a full on reboot had to be done. This looks like some SIC out of trust but not really type issue, very odd. I am going to open up a call with the diamond team tomorrow and they better not give me another 2.6 custom patch that causes more damage then fixes(where the hell is HFA01?). I'll post if I find true blue solution

[foyster]

We have been seeing the same thing as you all with disconnected FW's and or CPu in Smart View monitor displeying 1005

I have raised a Checkpoint call regarding this disconnection issue and Checkpoints response is “the issue is connected to multi cpu of firewalls.” And “This issue is currently investigated by R&D.”


For other CPUg comments on the same issue:


Smartview monitor - 1 gateway disconnected