> Source: [sk175187](https://support.checkpoint.com/results/sk/sk175187)

# sk175187 - "Policy installation failed on gateway. If the problem persists contact Check Point support (Error code: 0-3-4000027)" when upgrading the Security Management Server

| Property | Value |
|----------|-------|
| Solution ID | sk175187 |
| Date Created | 2021-08-30 |
| Last Modified | 2023-03-08 |
| Technical Level | Advanced |
| Products | Security Gateway, Security Management Server |
| Versions | R81.10 (EOS), R81 (EOS), R81.10 (EOS), R81 (EOS) |

## Symptoms

- * Policy installation fails with the error below after the user upgrades Security Management to R81.10, R81, R80.40 Jumbo Hotfix Take 114, R80.30 Jumbo Hotfix Take 235, R80.20 Jumbo Hotfix Take 202, or R80.10 Jumbo Hotfix Take 290:

  <br />


  "`Policy installation failed on gateway. If the problem persists contact Check Point support (Error code: 0-3-4000027).`"

  <br />


  **Notes**:

  * Enabled blade: Aplication Control
  * Custom Application is defined.

  <br />

* User Space debugs on the Security Gateway during policy installation (`TDERROR_ALL_ALL=5 fw fetchlocal -d $FWDIR/state/__tmp/FW1/ >& inst.txt`) show:


  ```
  
  ?fw_atomic_get_cmi_loader_load_params: Failed to get 'urlf_ssl_cn_enabled' param
  fw_atomic_clean_cmi_loader_load_params:
  fw_cmi_loader_get_load_params: fw_atomic_get_cmi_loader_load_params() failed
  ?
  [ERROR]: CInstallPolicyMgr::loadPrepareUsermode: loadUsermodeMt() failed for load_prepare
  ?
  [ERROR]: run_install_policy_wrapper: runInstallPolicy failed?
  ```

  <br />

* Code-generation debugs on Security Management show:

  ```
  
  ?export INTERNAL_POLICY_LOADING=1
  fwm load   >& debug.txt"
  
  APPIGenerator::LoadObjects: Working on object: 'Urls_Block_HostingInterno'
  UserApplication::GenerateRiskTag: unknown risk, no need to create it
  UserPattern::GenerateWildcardString: original string: *
  UserPattern::GenerateWildcardString: string after percent decoding : *
  UserPattern::GenerateWildcardString: found '*' prefix
  UserPattern::GenerateWildcardString: _pattern_str is empty
  UserPattern::GeneratePattren: GenerateWildcardString failed
  UserPattern::Load: GeneratePattren() failed
  UserApplication::LoadSignatures: UserPattern::Load() failed
  UserApplication::Load: LoadSignatures() failed
  APPIGenerator::LoadObjects: Load() failed for 'user_application' object
  gen_appi_custom_apps: appi_generator->LoadObjects() failed
  gen_appi_set: gen_appi_custom_apps() failed
  Failed to generate APPI set
  gen_https_inspection_cpset()failed
  ```

  <br />

## Cause

Policy installation fails because of incorrect configuration of Custom Application, which appears during code-generation on the Security Management Server.  

During policy installation, the Security Management Server checks if a Custom Application has an incorrect URL:  

* URL contains only ***** for a non-regular expression.
* URL contains only **.***for a regular expression.

If the Custom Application contains an incorrect URL, it is removed to prevent performance issues.  

![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk175187/2023-02-24 09_41_32-Check Point PartnerMAP - Partners Portal for Licensing, Support and Account Mana202302240942431.png)

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content