> Source: [sk10200](https://support.checkpoint.com/results/sk/sk10200) # sk10200 - 'too many internal hosts' error in /var/log/messages on Security Gateway | Property | Value | |----------|-------| | Solution ID | sk10200 | | Date Created | 2002-02-28 | | Last Modified | 2018-01-23 | | Technical Level | General | | Products | Security Gateway | | Versions | R82.10, R82, R81.20 | ## Symptoms - * '`too many internal hosts`' error in /var/log/messages on Security Gateway. * Traffic that passed through Security Gateway is processed very slowly. ## Cause There are many possible causes for this error: * The number of nodes behind the Security Gateway is greater than allowed by limited hosts license: Security Gateway listens for any IP-based traffic on all interfaces except for the one deemed "external", which is decided by the user and listed in `$FWDIR/conf/external.if` file. Anytime a host is "heard" talking on a non-external interface, Security Gateway logs this information in `$FWDIR/database/fwd.h` file and in `$FWDIR/database/fwd.hosts` file on the Security Gateway. Once the Security Gateway has heard '`n`' IP addresses ('n' is determined by the number of hosts permitted by your license), connections from the '`n+1`' host will generate messages to `/var/log/messages` file. * The name of the interface listed in the `$FWDIR/conf/external.if` file does not match the exact name of the interface that was assigned by the Operating System. * Internal objects with Static NAT are not properly configured. * Routing tables are not properly configured. * Incorrect Security Gateway version is installed on ESX VMWare (only Security Gateway Virtual Edition is supported on ESX VMWare). * [APIPA](http://en.wikipedia.org/wiki/APIPA) is configured on Security Gateway that runs on Windows OS. ## Solution Follow these steps to resolve the problem: ------------------------------------------ **For R70 and higher** 1. Copy the name of the interface, per above steps, based on operating system. 2. Stop Check Point services: **`[Expert@HostName]# cpstop`** 3. Create the file `$FWDIR/conf/external.if`: **`[Expert@HostName]# touch $FWDIR/conf/external.if`** 4. Edit the `$FWDIR/conf/external.if` file in VI editor: **`[Expert@HostName]# vi $FWDIR/conf/external.if`** 5. Add the exact name of the external interface into the `$FWDIR/conf/external.if` file. 6. Save the changes in the file and exit from Vi editor. 7. Start Check Point services: **`[Expert@HostName]# cpstart`** 8. Connect with SmartDashboard to Security Management Server / Provider-1 CMA / Domain Management Server. 9. Open the Security Gateway object - Properties - go to '`Topology`' pane - verify that the name external interface is correct and matches the name of the interface added into the `$FWDIR/conf/external.if` file. 10. Install Security policy onto Security Gateway object. Follow these steps to remove the messages: ------------------------------------------ 1. Connect to the command line of Security Gateway. 2. Clear all entries from the `host_table` kernel table: **`[Expert@HostName]# fw tab -t host_table -x`** Reply with a "`yes`" to the question "`are you sure?`". **Note:** ***"host_table"*** table holds the IP addresses (in Hex format) of internal machines protected by the Security Gateway / Cluster member. The table only exists where the FireWall license is for a limited number of machines behind the Security Gateway / Cluster member. The maximum number of entries in this table is the allowed number of internal machines The table is static - there is no timeout for its entries. It is supposed to be reloaded every time a policy is installed. **"host_ip_addrs"** table holds the IP addresses (in Hex format) of the local interfaces (including loopback) on Security Gateway / Cluster member. The table is static - there is no timeout for its entries. It is supposed to be reloaded every time a policy is installed. If errors continue, proceed with the following steps: ----------------------------------------------------- **Note** : The command **`fw lichosts`** will show IP addresses detected by the Security Gateway and counted against the license. Improper configuration of routing tables, Static NAT objects, or internal routers will result in output of the this command showing IP addresses that are not members of the internal network. **Troubleshoot Static NAT** 1. Log in to SmartDashboard. 2. Go to '`Manage`' menu - '`Network Objects...`'. 3. Select 'Static NAT object' \> '`Edit...`'. 4. Verify the '`General`' tab contains the internal IP address, not the external IP address, to which it is being translated. 5. Check the route table. The Static route on the firewall should be the virtual IP (routable) address to the real IP (internal) address of the NAT object. 6. If the route is correct, but the NAT rule is not being applied, check the NAT Rule Base and correct it, so the correct NAT rule is applied. This will ensure the firewall does not count the external IP address of the NAT object against the license. **Troubleshooting internal or gateway routers** There is another path from the external network into the internal network. Some connections that originated on the outside are coming into the internal network via that path. Correct routing or increase the license. Additional troubleshooting: 1. Disable Automatic Private IP Addressing ([APIPA](http://en.wikipedia.org/wiki/APIPA)) on Windows 2000, if the IP Address 169.254.x.x is being added to host_table. * Per the steps above, at the command line type: `ipconfig /all`. * If the "`Autoconfiguration Enabled`" line displays "`yes`", and the Autoconfiguration IP address is `169.254.x.x`, then the computer is using Automatic Private IP Addressing (APIPA). * Start Windows built-in Registry Editor: Start menu - '`Run...`' - type **`regedit`** - click OK / press Enter key. **Important Note:** Before proceeding, refer to these Microsoft KB articles: * [kb136393 (How to Modify the Windows Registry)](http://support.microsoft.com/kb/136393) * [kb256986 (Windows registry information for advanced users)](http://support.microsoft.com/kb/256986)

* Disable APIPA in the registry by adding "`IPAutoconfigurationEnabled`" DWORD registry entry, with a value of "`0x0`" to the key: `HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\Tcpip\Parameters|interfaces Adapter subkey`. * Save and exit. * Reboot the machine.

2. There is an internal user who is spoofing other IP addresses. * If it is a SecureServer machine, go to '`Manage`' menu \> '`Network Objects...`' - select the object. * Select the '`Topology`' tab, and verify the correct Interface is set to `External`. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content