12/2/22, 2:33 PM Threat Prevention policy fail after upgrade (of Security Management or Gateway) from R80.

20

Support Center > Search Results > SecureKnowledge Details

Search Support Center

Threat Prevention policy fail after upgrade (of Security Management or Gateway) from Technical Level

R80.20

My Favorites Email Pri

Solution ID sk169714

Technical Level

Product Anti-Virus, Anti-Bot

Version R80.40, R81, R81.10
Date Created 29-Sep-2020
Last Modified 13-Jul-2022

Symptoms
Threat Prevention Policy push via SmartConsole fails with the following error:

"Failed - Policy installation failed on the gateway. (Info: failed to handle indicators, )."

After the Management upgrade

Cause
This happens when the Threat Prevention policy contains Indicators (ioc) due to incompatibility between R80.20 and higher.

After the policy push from the upgraded Management, the Gateway fails to read $FWDIR/amw/ioc/cur/ioc_gen_params.C  because an attribute "indicators" has chang
"indicators_sha".

Solution
1. Backup and delete the $FWDIR/amw/ioc/cur/ioc_gen_params.C file on the affected Gateway (or each VS.)

2. Push Threat Prevention Policy again.

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

Give us Feedback Please rate this document [1=Worst,5=Best]

Enter your comment here

Comment 

SECURE YOUR EVERYTHING ™ Follow Us    

©1994-2022 Check Point Software Technologies Ltd. All rights reserved.

Copyright | Privacy Policy

https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk169714&partition=Advanced&pr… 1/1