unable to connect to server

[PeterSmith78]

I wonder if anyone could help me

I have recently tried to upgrade a primary management server from R77.20 to GAIA 88.10
The upgrade went OK and I imported the database using "migrate import" with no errors.
However if I try to open smart console R88.10 I get the message "unable to connect to server"
I have run the following commands:

[Expert@FWMANAGE01:0]# cd $MDS_FWDIR
[Expert@FWMANAGE01:0]# cd scripts
[Expert@FWMANAGE01:0]# ./cpm_status.sh
Check Point Security Management Server is during initialization

[Expert@FWMANAGE01:0]# ./server_status.sh Checking server status. Please wait...
Enabling local sic. Setting cp.ssl_local.certificate.check=local
Server is up - but not ready to receive connections (fwm might be down or busy) [Expert@FWMANAGE01:0]#

(I'm also not able to use clish, but this may be an unrelated issue - I get the message CLINFR0479 You can't start interactive session from another interactive session)

many thanks

[PeterSmith78]

just to add I get the following error when I do "fw debug fwm on"

[Expert@FWMANAGE01:0]# [Expert@FWMANAGE01:0]# fw debug fwm on
bash: [Expert@FWMANAGE01:0]#: command not found
[Expert@FWMANAGE01:0]# Cannot signal process fwm (17282), make sure the process is running.: No such process

[JPYDX]

Have you downloaded and installed latest Jumbo HF? along with any other relevant recommended downloads for your server?

This has prevented me logging in before

[PeterSmith78]

thanks for your reply. Yes I've downloaded them but no luck unfortunately

[cciesec2006]

thanks for your reply. Yes I've downloaded them but no luck unfortunately

Is it related to the certificate expiration that was well documented with checkpoint?

[jflemingeds]

Is it related to the certificate expiration that was well documented with checkpoint?

That only effected new installs of R77 after jan 24 2018 from reading SK22612.

[PeterSmith78]

Thanks for replies

I've run cpca_client lscert and there are a couple of hundred expired certificates for users (which are all obsolete). I did to a search for SK22612 but can't seem to find it.
I would have though that the R88.10 pre-upgrade verifier should have picked up if expired certificates were an issue but perhaps it doesn't check for these...

[Serge17]

I have the same issue after upgrading from R77.30. My problem is described here: sk119732 and sk115599, but I don't have an access to read solution.
Anybody can help?

[cciesec2006]

Thanks for replies

I've run cpca_client lscert and there are a couple of hundred expired certificates for users (which are all obsolete). I did to a search for SK22612 but can't seem to find it.
I would have though that the R88.10 pre-upgrade verifier should have picked up if expired certificates were an issue but perhaps it doesn't check for these...

It is checkpoint, do you expect more?

I am still having issues with upgrading from Provider-1 R77.30 to R80.10 and after a few months, I simply gave up :-(

[Serge17]

I have the same issue after upgrading from R77.30. My problem is described here: sk119732 and sk115599, but I don't have an access to read solution.
Anybody can help?

Anybody installed R80.10 on CP 4200 firewall such as firewall and management server?

[Bob_Zimmerman]

This is maybe a silly question, but did you go through the web UI setup wizard (or equivalent) before running the 'migrate import'?

What does 'cpwd_admin list' return?

[eranh]

Hi Peter,

My name is Eran and I'm a manager in the R&D of CheckPoint, responsible for the core of the Management Server.
First, I would like to say that I'm sorry for the issue you're experiencing and I will do whatever I can to assist you and others who run into the same issue.

The possible explanations for such login issue could be either:

1. CPM is down.
2. CPM is up but didn't really load properly.
3. CPM is up but FWM is down.
4. CPM and FWM are both up but for some reason fail to handle the login request properly.

According to the server_status.sh script, it seems the CPM process is up but still login fails, so we eliminate #1.
To be able to proceed with some tips or guidelines, I would appreciate it if you could say whether your machine is a SmartCenter or a Multi Domain Server.

Thanks,
Eran

[Serge17]

Anybody installed R80.10 on CP 4200 firewall such as firewall and management server?

The 4200 appliance does not support StandAlone deployment at all.
https://supportcenter.checkpoint.com...=&fileid=54509

[jflemingeds]

The 4200 appliance does not support StandAlone deployment at all.
https://supportcenter.checkpoint.com...=&fileid=54509

Yeah so upgrade the ram to 8 gig.
</shifteyes>

[Serge17]

Yeah so upgrade the ram to 8 gig.
</shifteyes>

I can't check Management server in initial configuration. So think that upgrade RAM will not help...

[cciesec2006]

I can't check Management server in initial configuration. So think that upgrade RAM will not help...

What do you mean you can't in initial configuration? You should be able to have access to the CLI even in the initial configuration right?

In expert mode: cat /proc/meminfo

[Expert@CP-NG:0]# fw ver
This is Check Point's software version R80.10 - Build 027
[Expert@CP-NG:0]# cat /proc/meminfo
MemTotal: 12153532 kB
RawMemTotal: 0 kB
MemFree: 5608396 kB
Buffers: 290028 kB
Cached: 2358536 kB
SwapCached: 0 kB
Active: 3211004 kB
Inactive: 1261464 kB
HighTotal: 0 kB
HighFree: 0 kB
LowTotal: 12153532 kB
LowFree: 5608396 kB
SwapTotal: 26764280 kB
SwapFree: 26764280 kB
Dirty: 3036 kB
Writeback: 0 kB
AnonPages: 1821768 kB
Mapped: 157788 kB
Slab: 423788 kB
PageTables: 9052 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
CommitLimit: 32841044 kB
Committed_AS: 3638664 kB
VmallocTotal: 34359738367 kB
VmallocUsed: 1636012 kB
VmallocChunk: 34358056483 kB
HugePages_Total: 0
HugePages_Free: 0
HugePages_Rsvd: 0
Hugepagesize: 2048 kB
[Expert@CP-NG:0]#

[Serge17]

What do you mean you can't in initial configuration? You should be able to have access to the CLI even in the initial configuration right?

In expert mode: cat /proc/meminfo

[Expert@CP-NG:0]# fw ver
This is Check Point's software version R80.10 - Build 027
[Expert@CP-NG:0]# cat /proc/meminfo
MemTotal: 12153532 kB
RawMemTotal: 0 kB
MemFree: 5608396 kB
Buffers: 290028 kB
Cached: 2358536 kB
SwapCached: 0 kB
Active: 3211004 kB
Inactive: 1261464 kB
HighTotal: 0 kB
HighFree: 0 kB
LowTotal: 12153532 kB
LowFree: 5608396 kB
SwapTotal: 26764280 kB
SwapFree: 26764280 kB
Dirty: 3036 kB
Writeback: 0 kB
AnonPages: 1821768 kB
Mapped: 157788 kB
Slab: 423788 kB
PageTables: 9052 kB
NFS_Unstable: 0 kB
Bounce: 0 kB
CommitLimit: 32841044 kB
Committed_AS: 3638664 kB
VmallocTotal: 34359738367 kB
VmallocUsed: 1636012 kB
VmallocChunk: 34358056483 kB
HugePages_Total: 0
HugePages_Free: 0
HugePages_Rsvd: 0
Hugepagesize: 2048 kB
[Expert@CP-NG:0]#

I can't check it here (tried IE and Chrome):


[Expert@cp-krm:0]# fw ver
This is Check Point's software version R80.10 - Build 423
[Expert@cp-krm:0]# cat /proc/meminfo
MemTotal: 4068948 kB
RawMemTotal: 5242880 kB
MemFree: 3538040 kB
Buffers: 23076 kB
Cached: 421668 kB
SwapCached: 0 kB
Active: 132016 kB
Inactive: 369436 kB
HighTotal: 2349632 kB
HighFree: 1860188 kB
LowTotal: 1719316 kB
LowFree: 1677852 kB
SwapTotal: 10514532 kB
SwapFree: 10514532 kB
Dirty: 324 kB
Writeback: 16 kB
AnonPages: 56744 kB
Mapped: 56008 kB
Slab: 14356 kB
PageTables: 2788 kB
NFS_Unstable: 0 kB
Bounce: 4 kB
CommitLimit: 12549004 kB
Committed_AS: 459792 kB
VmallocTotal: 247800 kB
VmallocUsed: 10048 kB
VmallocChunk: 236000 kB
HugePages_Total: 0
HugePages_Free: 0
HugePages_Rsvd: 0
Hugepagesize: 2048 kB

[cciesec2006]

I can't check it here (tried IE and Chrome):


[Expert@cp-krm:0]# fw ver
This is Check Point's software version R80.10 - Build 423
[Expert@cp-krm:0]# cat /proc/meminfo
MemTotal: 4068948 kB
RawMemTotal: 5242880 kB
MemFree: 3538040 kB

so the box only has 4GB of RAM. According to the SK, you need at least 8GB RAM:

Notes:

The 4200 appliance does not support StandAlone deployment at all.
These appliance models do not support a Standalone deployment with their default RAM (4GB):
4400, 4600, 4800, 12200, 12400.
Upgrade these models to at least 8 GB RAM to support a Standalone deployment.
The Smart-1 25B, 205, 210, 405, 410 appliances can run Security Management OR Log Server OR SmartEvent.

[Serge17]

so the box only has 4GB of RAM. According to the SK, you need at least 8GB RAM:

Notes:

The 4200 appliance does not support StandAlone deployment at all.
These appliance models do not support a Standalone deployment with their default RAM (4GB):
4400, 4600, 4800, 12200, 12400.
Upgrade these models to at least 8 GB RAM to support a Standalone deployment.
The Smart-1 25B, 205, 210, 405, 410 appliances can run Security Management OR Log Server OR SmartEvent.

pgrade these models to at least 8 GB RAM to support a Standalone deployment.
This doesn't apply to 4200 (The 4200 appliance does not support StandAlone deployment at all.)

Thanks!

[jflemingeds]

pgrade these models to at least 8 GB RAM to support a Standalone deployment.
This doesn't apply to 4200 (The 4200 appliance does not support StandAlone deployment at all.)

Thanks!

Well.. there is supported.. and then there is possible...

I'm assuming this for a lab box since a 4200 is a pretty sad box for a mgmt server.

crack the box open (oh noes!), look at the chipset to see what max ram it an really supports and do what you need. If you want to make it a pure mgmt config do a fresh install, don't complete the wizard then look at config_system script and try making it mgmt only server. Might not work.. but then again that is a shell script so take at look at what its doing and figure it out.

While your at it put a hard drive in. Maybe even a SSD? Its just a intel box with intel nics in it. Should be possible. Supported? Nopers..