> Source: [sk134054](https://support.checkpoint.com/results/sk/sk134054) # sk134054 - Rare failure in the Identity Sharing network registration may potentially result in incorrect policy actions | Property | Value | |----------|-------| | Solution ID | sk134054 | | Date Created | 2018-08-15 | | Last Modified | 2019-04-03 | | Technical Level | General | | Products | Security Gateway | | Versions | R82.10, R82, R81.20 | | OS | Gaia | ## Symptoms - * When using Identity Sharing with SmartPull, the PDP publishes a network to the PEP, but the PEP fails to register to this network later. * Using Access Roles in the rule base might cause incorrect policy actions on Security Gateways running R80.10. * The rule that is enforced is not the one with the Access Role (as should be the case), but rather a different, irrelevant rule. * On kernel debug, D_HOLD action returned multiple times for the same packet (Hold loop): ``` up_manager_fw_handle_first_packet: after POST_SYN context - hold was requested by one of the classifiers; up_manager_fw_handle_first_packet: returning D_HOLD; ``` * In SmartLog, after a while, the following Identity Awareness log may appear: `"Peer closed connection"`. ## Cause The connection is handled by the PEP Gateway, but no identity is found on the PEP for the connection�s IPs. With smart pull Identity sharing, the PEP Gateway will hold the connection if: 1. The Access Role is used in the policy and required for the final rulebase match. 2. There is a remote PDP Gateway that previously published this network to the PEP Gateway. The PEP Gateway will try to register to the network (to get identities on these IPs) by sending a request to the remote PDP Gateway. If there is well timed outage between the PDP and PEP, and between the publish and the registration phases (for example, a connectivity issue between PDP-PEP), the PEP Gateway will try to hold the packet repeatedly. As a result, the hold operation may fail because of a limit on concurrent possible holds. Such a failure will cause connections to be accepted. ## Solution This problem was fixed. The fix is included in: * [**Check Point R80.20**](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk122485) * **[Security Gateway R80.10 Hotfix for sk134054](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=71684)** **The Hotfix should be installed on Security Gateway with R80.10 Jumbo Hotfix Take_121.** It also include a fix to [SegmentSmack (CVE-2018-5390) and FragmentSmack (CVE-2018-5391)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk134253).
It is highly recommended to use CPUSE for downloading and installing the hotfix: Click Here to Show the Entire Section * Show / Hide instructions for CPUSE in Gaia Portal * Online Installation 1. [CPUSE Software Updates Policy](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How%20to%20work%20with%20CPUSE%20-%20Additional%20How%20To) should be configured to allow self-update of CPUSE Agent. Otherwise, users should manually install the latest build of CPUSE Agent from [sk92449](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#Latest%20build%20of%20CPUSE%20and%20What%27s%20New). 2. Connect to the Gaia Portal on your Check Point machine. 3. Navigate to ***Upgrades (CPUSE)*** pane - click on ***Status and Actions***. 4. In the upper right corner, click the Add hotfixes from the cloud button and search for: Check_Point_R80.10_Hotfix_sk134054_FULL.tgz 5. When the package is found, click the link to add the package to the list of available packages. 6. Select the hotfix package R80.10 hotfix for sk134054 - click the Download button on the toolbar. 7. Verify the package - check whether this package can be installed without conflicts: Select the hotfix package R80.10 hotfix for sk134054 - click the More button on the toolbar - click Verifier. 8. Select the hotfix package R80.10 Hotfix for sk134054 - click the Install Update button in the toolbar. 9. Reboot is required.
Note - **The machine will automatically reboot after installation**! * Offline Installation 1. Install the latest build of CPUSE Agent from [sk92449](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#Latest%20build%20of%20CPUSE%20and%20What%27s%20New). 2. Download the Gaia CPUSE Offline package: |----------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | OS | R80.10 | | Gaia - CPUSE Offline | [![](https://sc1.checkpoint.com/sc/images/download-m.png)](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=71684) | 3. Connect to the Gaia Portal on your Check Point machine. 4. Navigate to ***Upgrades (CPUSE)*** pane - click on ***Status and Actions***. 5. On the toolbar, click on the **More** button - select **Import Package** - browse for the CPUSE Offline package (TGZ file) - click on the ***Upload***. 6. Verify the package - check whether this package can be installed without conflicts: Select the hotfix package ***R80.10 Hotfix for sk134054*** - click on the ***More*** button on the toolbar - click on the ***Verifier***. 7. Select the hotfix package ***R80.10 Hotfix for sk134054*** - click on the ***Install Update*** button on the toolbar. 8. Reboot is required. **Notes**: * For detailed installation instructions, refer to [sk92449: CPUSE - Gaia Software Updates (including Gaia Software Updates Agent)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How%20to%20work%20with%20CPUSE) - section "(4) How to work with CPUSE". * Make sure to take a snapshot of your Check Point machine before installing this hotfix. * In cluster environment, this procedure must be performed on all members of the cluster. * Show / Hide instructions for CPUSE in Gaia Clish * Offline Installation 1. Download the Gaia CPUSE Offline package: |----------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | OS | R80.10 | | Gaia - CPUSE Offline | [![](https://sc1.checkpoint.com/sc/images/download-m.png)](https://supportcenter.checkpoint.com/supportcenter/portal?action=portlets.DCFileAction&eventSubmit_doGetdcdetails=&fileid=71684) | 2. Install the latest build of CPUSE Agent from [sk92449](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#Latest%20build%20of%20CPUSE%20and%20What%27s%20New). 3. Transfer the offline package to the target Gaia machine (into some directory, e.g., */some_path_to_fix/*). 4. Connect to the command line on target Gaia OS. 5. Log in to Clish. 6. Acquire the lock over Gaia configuration database: ***HostName\> lock database override*** 7. Import the package from the hard disk: ***HostName\> installer import local \/*** ***Check_Point_R80.10_Hotfix_sk134054_FULL.tgz*** 8. Show the imported packages: ***HostName\> show installer packages imported*** 9. Verify that this package can be installed without conflicts: ***HostName\> installer verify \*** 10. Install the imported package: ***HostName\> installer install \*** 11. Reboot is required. **Notes**: * For detailed installation instructions, refer to [sk92449: CPUSE - Gaia Software Updates (including Gaia Software Updates Agent)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How%20to%20work%20with%20CPUSE) - section "(4) How to work with CPUSE". * Make sure to take a snapshot of your Check Point machine before installing this hotfix. * In cluster environment, this procedure must be performed on all members of the cluster.
### Uninstall Instructions Click Here to Show the Entire Section * Show / Hide instructions for CPUSE in Gaia Portal 1. [CPUSE Software Updates Policy](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How%20to%20work%20with%20CPUSE%20-%20Additional%20How%20To) should be configured to allow self-update of CPUSE Agent. Otherwise, users should manually install the latest build of CPUSE Agent from [sk92449](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#Latest%20build%20of%20CPUSE%20and%20What%27s%20New). 2. Connect to the Gaia Portal on your Check Point machine. 3. Navigate to ***Upgrades (CPUSE)*** pane - click on ***Status and Actions***. 4. Select the hotfix package ***R80.10 Hotfix for sk134054*** - click on the ***Uninstall*** button on the toolbar. 5. Reboot is required. **Notes**: * For detailed installation instructions, refer to [sk92449: CPUSE - Gaia Software Updates (including Gaia Software Updates Agent)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How%20to%20work%20with%20CPUSE) - section "(4) How to work with CPUSE". * Make sure to take a snapshot of your Check Point machine before uninstalling this hotfix. * In cluster environment, this procedure must be performed on all members of the cluster. * Show / Hide instructions for CPUSE in Gaia Clish 1. Install the latest build of CPUSE Agent from [sk92449](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#Latest%20build%20of%20CPUSE%20and%20What%27s%20New). 2. Connect to the command line on target Gaia OS. 3. Log in to Clish. 4. Acquire the lock over Gaia configuration database: ***HostName\> lock database override*** 5. Show the installed packages: ***HostName\> show installer packages installed*** 6. Uninstall the hotfix package: ***HostName\> installer uninstall \*** 7. Reboot is required. **Notes**: * For detailed installation instructions, refer to [sk92449: CPUSE - Gaia Software Updates (including Gaia Software Updates Agent)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How%20to%20work%20with%20CPUSE) - section "(4) How to work with CPUSE". * Make sure to take a snapshot of your Check Point machine before uninstalling this hotfix. * In cluster environment, this procedure must be performed on all members of the cluster.
Note that the fix is also included in: * **[Jumbo Hotfix Accumulator for R80.10 Take_131](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116380)** (and higher) --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content