> Source: [sk172364](https://support.checkpoint.com/results/sk/sk172364)

# sk172364 - Appliance with enabled IPv6 and 40 FW instances may stop responding on boot 

| Property | Value |
|----------|-------|
| Solution ID | sk172364 |
| Date Created | 2021-03-04 |
| Last Modified | 2021-10-21 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |
| Platform | 15000, 3000, 28000, 26000 |

## Symptoms

- * After an upgrade to R80.40 Jumbo Hotfix Takes 91/93, the appliance in kernel mode with enabled IPv6 and 40 FW instances may not respond on boot and enters into maintenance mode.

* These errors show on the appliance console during boot:  

  `"CKP: Loading FW-1 IPv4 Instance 35: insmod: error inserting '/etc/fw.boot/modules/fw_kern_64_3_10_64.o': -1 Cannot allocate memory"`

* These errors show on the appliance console during boot:  

  `"netns: internal error, please report a bug!failed to set nsid
  ...
  CKP: Loading FW-1 IPv4 Instance 13: [ OK ]
  INIT: Sending processes the TERM signal
  Removing all namespaces: netns: A number is expected.
  NIT: Sending processes the KILL signal"`

* Checking dmesg in "sh-4.4#" shell, shows : "\[ 36.998738\] insmod: page allocation failure: order:0, mode:0xd2"

## Cause

* When running in Kernel mode, the firewall instances are loaded into the driver (when running as USFW it is a dynamic loaded library).
* There are only 2GB of memory to load drivers and at least 500M is used by the OS.  
  2G is for all drivers loaded, including SecureXL (4 and 6) and FW (4 and 6 per instance).
* The issue occurs when the device reaches the maximum size (2G). It results in a memory allocation failure that causes the OS to revert to init mode 1.

<br />

Contributing factors triggering the issue:  

* Non-VSX Firewall operating in Kernel mode.
* High instance count (32, 36 etc).
* IPv6 is enabled - which means additional firewall instances and SIM modules are loaded.

<br />

## Solution

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R80.40](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456) starting from Take 94
* [Jumbo Hotfix Accumulator for R80.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk153152) starting from Take 235

If you choose not to upgrade, change the firewall configuration to operate in **User Space Firewall** mode, do these steps:  

1. Set the following **cpprod_util** values (0=kernel, 1=USFW) on your device:  
   **# cpprod_util FwSetUsermode <0 - off, 1 - on>**  
   **# cpprod_util FwSetUsfwMachine <0 - off, 1 - on>**  

2. Reboot the device  

**To check the current mode, run:**   
**`# cpprod_util FwIsUsermode `**   
**`# cpprod_util FwIsUsfwMachine `**   

Output: 0=kernel mode, 1=USFW mode

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content