Load on Module Failed - Failed to load Security Policy

[yairitay]

Hi,
The following error message appear when I try to install the policy on the remote box..

Installation failed. Reason: Load on Module failed - failed to load Security Policy.

I have installed SPLAT R60 on VMware GSX ver. 3

I tried to remove the interfaces and add them back which I suggested on another forum, but it did not help too much.

Any idea?

[yowieWithin]

Hi,

I would:
1) Do a fw fetch of the new policy from the command line.
2) Stop & start the daemons on the firewall, then try pushing the policy again
3) Check out the firewall's free disk space & memory.
4) Check out /var/adm/messages , or wherever syslog is logging errors to see if there are clues there.
5) snoop/tcpdump on the module and maybe see which end finishes the connection

How did you get to this point?
Did it ever work?
What's changed?

YW

[yairitay]

When I fw fetch <module name> the following error appear:

sic name does not match

How did you get to this point? This is new installation
Did it ever work? Yes, not on VMware


Thanks..

[yowieWithin]

Check that the firewall object name=the name of the host in the hosts file.

[xfiles]

I experienced the same issue on several NGX/SPLAT installations. After
removing all "rule names" from security rules the policy installs without any problems. Must be a bug in R60 even with HFA01.

[xfiles]

Sorry on my last post, it doesnt address your problem.
I got "Installation failed. Reason: Load on Module failed - no memory" errors, when i had too many entries in the rule name column.

[Lackie]

Check to make sure that there is enough disk space in the VMware session. Also, with the SIC error when doing the fetch, I would reset SIC between the MGT and firewall.

[pierrot]

i have something like that on our CP NG60 (upgraded from NG54)
"Installation failed. Reason: Load on Module failed - no memory"
it happend just after i delete a rule (created with NG54 and deleted whith NG60)

i had the same problem 2 month later just after the upgrade to NG60
i just deleted a user (VPN user) and tried to install the policies ...
when i saw the message (no memory) i thought that the CP needs a simple reboot .... ho my god !! CP didn't boot and i have to re-install the old one (a ghost of the NG54) and to re-upgrade to NG60 !!
never again !!

so, what is the real problem ?
what can i do to install the new policies ?
what could happened if i shut down the CP ?
it seems (when every thing is OK) that i can create new rules but can't delete one of existing rules (from NG54).

[kva.kva]

I had some problems with NGX on VMWare too. It's problems with low system's resources, like processor's resources. NGX requires more resources then R55. I think so. With R55 I haven't got this problem.
When I shutdown some other servers on VMWare - policy was installed successful (there are a lot of memory, disk space on virtual NGX module and SmartCenter).

If you used "real" hardware, may be you should upgrade.

[Webcam007]

We get this exact same error message (Load on Module failed - failed to load Security Policy) in the process of trying to upgrade our enforcement modules and Management server up to NGX R60 from R55!

As far as I can tell both enforcement modules have been built to the same spec, they are running identical hardware and the route's etc are all the same. For some reason I push to one and its fine, I push the same rulebase to the other and it errors with this message!! SIC works fine and I can get Toplogy etc but it just won't accept a policy!! Have been fighting with this on and off for a few weeks now!! Going insane!!! Management is running Windows 2003 NGX R60 and the enforcement points are both SPLAT R60.

Any thoughts would be most gratefully received!!!

Webcam007

[Checkin]

Originally Posted by xfiles

I experienced the same issue on several NGX/SPLAT installations. After
removing all "rule names" from security rules the policy installs without any problems. Must be a bug in R60 even with HFA01.

Hi Xfiles,

I had the same problem - because of your posting I could solve the case immediately. Thanks!
By the way, you need not to remove all rule names. It was just one which made the problem: I used special german characters for the name. After removing this, all works fine again.
Checkin

[Sagitar]

Originally Posted by xfiles

I experienced the same issue on several NGX/SPLAT installations. After
removing all "rule names" from security rules the policy installs without any problems. Must be a bug in R60 even with HFA01.

Had the same prob right now... Removing the "rule names" removed the problem.. Thank you!!!

[Scorpio]

I have also seen this problem on a number of upgrades before. When upgrading from NG AI to NGX, sometimes the policy won't install to the module. We found that this issue is often caused by old SmartDefense signatures conflicting with the newly-upgraded module. When we updated SmartDefense, the policy installed without a problem.

[benner]

I just also experienced that problem with one of my customers.... Last week I've done an upgrade from R55 to R60.
The error message is "Installation failed. Reason: Load on Module failed - failed to load Security Policy."
I have already tested communication on port 18191 and port 256 from mgmt station to gateway.I could connect via telnet on those port. I can still access the module by ssh & https.
I have checked the SIC on the mgmt : status is communicating. Last Friday I was still able to push a policy and I've checked the changes and yes indeed, I've changed some of the rule names.

Will try to remove the names and if this works I will contact CP to report this bug.

[BarryStiefel]

Originally Posted by Sagitar

Had the same prob right now... Removing the "rule names" removed the problem.. Thank you!!!

I've seen this also in R60 HFA-01 through HFA-03 (haven't tested it on HFA-04). Sometimes there's just really weird unexplainable errors when pushing a policy and deleting everything in the "Name" column clears it right up.

[stuartgreen]

another one is to check that the firewall module services were actually installed in the first place :0)

[Brentd]

We just had the same situation happen (when pushing the rulebase got the no memory error) on a test setup of R60, we were able to track the problem down.

It happened when we had setup a VPN community (Simplified rules) and one of the firewalls in the community had the IP address setup within the topology config but we had not designated which interfaces were "This Network" or "External", both of the interfaces were both "Undefined".. When we set them correctly, the rule base pushed OK. Our setup was done in a "Virtual Server" virtual machine with Windows 2003 on one VM with the Console and the SmartCentre on it another VM running SPLAT no HFA installed yet! I hope this helps someone else.... Weirdest thing though, when we tried to simulate this problem on another setup just like this on the problem did not show its ugly head!

Brent

[Landoz]

Hi
the problem happens when you use special characters in Names column. e.g. if you use the character 'è' , installation fails. I guess that you cannot use characters above 128 in ASCII table.

yo

[BarryStiefel]

Originally Posted by Landoz

Hi
the problem happens when you use special characters in Names column. e.g. if you use the character 'è' , installation fails. I guess that you cannot use characters above 128 in ASCII table.

yo

I've seen it happen where if you put anything at all into the Names column you get this error. I'm recommending that you leave the Names column empty.

[jvalenzuela]

Hello guys

This is an article published on the Nokia site. This solved my problem. Hope so it'll help you.

*****************************************
Published:
July 13, 2006

Description:
Error message appears in NGX SmartDashboard while pushing new policy to the firewall:

Load on Module failed - no memory

Solution:
This can be caused by special, accented characters.

For example:

Ø, Ö, Ä, Ñ, ë, ß, etc...

Customers tend to write NOTEs, NAMEs or COMMENTs in the rule base in their native language and use language specific characters which are not accepted by NGX.

Please ask the customers to review all comments in the rulebase and remove all special characters.
*****************************************

Regards

Jorge