Just wondering if anyone has come across the issue I am having.
IPS has an issue automatically updating, but AV/AS doesn't, but thats not the issue, well not the main one.
So when I enter Smart Dashboard I get the warning IPS failed to update and then at the bottom right a popup appears saying do you want to update IPS or remind me later. If I chose update now it will download the latest IPS sigs and then install them. All seems fine and the first policy push I perform works without an issue. But if I try to install a policy a second time it fails with the unable to push policy not enough memory error, which from the checkpoint forums has nothing to do with a lack of memory instead it's just a general error message.
The only way to resolve the issue is to perform a restore from a version before the IPS update. This started happening after the 24/01/2011 IPS updates, and still happens with the current 30/01/2011 version.
Anyone have any thoughts or come across this?
--> Problems still the same!
What error message are you getting? Not enough memory?
"Not enough memory" generally indicates some kind of circular reference between two objects that cycles infinitely during policy compilation. The most common culprits are Node...Host objects that reference an IP address in use by a cluster object/firewall. Do you have any objects like that? It also might be interesting to right click Network Objects and choose Query...Refine By...Duplicates; try cleaning up duplicate objects and try again.
Check out the $FWDIR/log/fwm.elg file for the debug output. Not the easiest reading, but you should see something towards the bottom of the output that will indicate the objects involved in the circular reference.
I had a memory issue during ips install on IPSO cluster, but managed to circumvent it by dropping the ips to default level, installing and then rising it again to my settings and installing again. Now I have some memory chips waiting to be installed since the memory was actually too low during the install.
To my understanding your SPLAT uses swap while my flash IPSO doesn't, so don't know the root cause, but you could try the workaround until getting it to work.
Actually I've logged a TAC Case with Checkpoint via our reseller!
I apologise for not responding to the replies people were leaving. So far I haven't found a fix for this issue. I have disabled IPS updates and tell the warning message to, "Remind me late", but it will get the same answer then as well.
I'm raising this with my supplier today. As soon as I get a response with a possible fix/reason for the error I'll update the post.
2. Go to Global Properties > SmartDashboard Customization > Advanced Configuration > Configure > FireWall-1 > General > rulebase_uids_in_log.
3. Set the property to 'false'.
But unfortunatley, it didn't work. CPinfos, debugs are now on there way to Check Point.
I'll keep you informed of any updates.
I've send the possible solution to our supplier to let it have checked by checkpointsupport!
Just made the change to the file, but will have to wait till tonight to reboot the gateway.