> Source: [sk175504](https://support.checkpoint.com/results/sk/sk175504)
# sk175504 - How to configure Check Point software to upload data to Check Point / download data from Check Point in versions R81.20 and higher
| Property | Value |
|----------|-------|
| Solution ID | sk175504 |
| Date Created | 2021-09-19 |
| Last Modified | 2026-03-02 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server, Multi-Domain Security Management Server |
| Versions | R82.10, R82, R81.20, R82.10, R82, R81.20, R82.10, R81.20, R82 |
| OS | Gaia |
## Solution
**Important Note** - For Management Server versions R81.10 and lower, see [sk111080](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111080).
This article describes the Consent Flags in these scenarios for versions R81.20 or higher:
|--------------------------------|-------------------------------------------------------------------------------------------|
| Version of a Management Server | Version of a managed Security Gateway / Cluster / VSX Virtual System / VSX Virtual Router |
| R81.20 or higher | R81.20 or higher |
| R81.10 ^(\*)^ R81 ^(\*)^ | R81.20 or higher |
| R81.20 or higher | R81.10 or lower |
^(\*)^ For the supported forward compatibility, see [sk113113](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113113) - section "Management Servers and Security Gateways they can manage".
**Table of Contents:**
* (1) Summary of Consent Flags
* (2) Enabling and Disabling the Consent Flags
* (3) Consent Flag Decision Table
* (4) Where the Consent Flags are Stored
* (5) Known Limitations and Warnings
* (6) Troubleshooting
Click Here to Show the Entire Article
(1) Summary of Consent Flags {#Summary of Consent Flags}
--------------------------------------------------------
Show / Hide this section
> Enter the string to filter this table:
>
> |-----------------------|----------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
> | Consent Flag | Default Status | Description | Notes |
> | Download Security | Enabled | Controls the download of "Security" data from online Check Point servers: * Allows to update the installed Check Point products that are defined as "Security". For example, CPUSE Deployment Agent, Threat Emulation Engine. * Allows to download data that is defined as "Security". For example, signatures for the IPS Software Blade. | * After an upgrade to R81.20 or higher versions, this Consent Flag keeps the configured value from the previous version. |
> | Download Non-Security | Enabled | Controls the download of "Non-Security" data from online Check Point servers: * Allows to update the installed Check Point products that are defined as "Non-Security". For example, updates for the CPinfo tool. * Allows to download data that is defined as "Non-Security". | * After an upgrade to R81.20 or higher versions, this Consent Flag gets the new default value. |
> | Upload Information | Enabled | Controls the upload of anonymous data to online Check Point servers: * Allows to upload anonymous logs. For example, the upload of logs from the CPUSE tool. * Allows to upload anonymous diagnostics information. For example, the upload of data from the CPinfo and CPUSE tools. Check Point uses this data internally for bug analysis and to improve the products. All data is subject to the European privacy policy (GDPR). | * After an upgrade to R81.20 or higher versions, this Consent Flag keeps the configured value from the previous version. * This Consent Flag has priority over the setting "**Sync with User Center** " (refer to [sk94064](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk94064)). If you enabled the setting "**Sync with User Center** " (SmartConsole \> Manage \& Settings \> Sync with User Center), but did **not** enable this Consent Flag, then the Management Server does **not** synchronize with User Center. |
> | Upload Crash Data | Disabled | Controls the upload of core dump files to online Check Point servers: * Allows to upload core dump files that user space processes create during a failure. * Allows to upload core dump files that Gaia OS creates during a failure. Gaia OS uses the Core File Uploader tool to upload these files. Check Point uses this data internally for bug analysis and to improve the products. **Warning** - Because core dump files contain a snapshot of the memory, they can contain personal and sensitive information. | * After an upgrade to R81.20: * This Consent Flag (checkbox in SmartConsole) gets the new default value. * The local configuration (on the Security Gateway) of this Consent Flag in Gaia OS is removed. * After an upgrade from R81.20 to R82 or higher versions: * This Consent Flag (checkbox in SmartConsole) keeps the configured value from the previous version. * This local Consent Flag (on the Security Gateway) keeps the configured values from the previous version. |
>
> {#Unique_ID1Table}
>
> ### Consent Flag values on a Multi-Domain Security Management Server:
>
> * A newly created Domain copies the initial Consent Flag values from the Global (System) Domain.
>
> * The Global Domain manages the Consent Flags only for the MDS context.
>
> * All other Domains manage the Consent Flags only for themselves and for their manages Security Gateways / Clusters.
>
> ### Getting Consent Flag values from all managed Security Gateways / Cluster Members:
>
> 1. [Download this script to your computer](https://supportcenter.checkpoint.com/file_download?id=125617).
>
> 2. Copy the downloaded script to your Management Server to some directory (for example, */var/log/*).
>
> 3. Connect to the command line on the Management Server.
>
> 4. Log in to the Expert mode.
>
> 5. Go to the directory with the script:
>
> `cd /var/log`
> 6. Assign the "execute" permission to the script:
>
> `chmod -v +x consent_flags_status.py`
> 7. Run the script:
>
> `./consent_flags_status.py`
>
> Example output:
>
> ```
> [Expert@MyMgmt:0]# ./consent_flags_status.py
> Data Extraction In Progress... Might take a while.....
>
> Upload Flag Status - (1)
> The Upload Flag Is Using The Management Settings - (2)
> Download Security Flag Status - (3)
> The Download Security Flag Is Using The Management Settings - (4)
> Download Non Security Flag Status - (5)
> The Download Non Security Flag Is Using The Management Settings - (6)
> Upload Crash Data Flag Status - (7)
> The Upload Flag Is Using The Management Settings - (8)
>
> -------------------------------------------------------------------------------------------------------------------
> |Gateway Information |(1) |(2) |(3) |(4) |(5) |(6) |(7) |(8) |
> -------------------------------------------------------------------------------------------------------------------
> | | | | | | | | | |
> |Name: GW-A |Enabled |True |Enabled |True |Disabled |True |Disabled |True |
> |IP: 192.168.3.4 | | | | | | | | |
> |Version: R81.20 | | | | | | | | |
> |Domain: MyDomain1 | | | | | | | | |
> | | | | | | | | | |
> -------------------------------------------------------------------------------------------------------------------
> [Expert@MyMgmt:0]#
> ```
>
> Note - This script uses the "`cpprod_util`" tool, "`cprid_util`" tool, and Management API to get the required data.
(2) Enabling and Disabling the Consent Flags {#Enabling and Disabling the Consent Flags}
----------------------------------------------------------------------------------------
You can enable and disable the Consent Flags in these ways:
**Important** - See "(3) Consent Flag Decision Table".
### (2-A) In Gaia First Time Configuration Wizard (FTCW)
Show / Hide this section
> On the last page "**First Time Configuration Wizard Summary** " \> at the bottom, click in "`Review Update and Data Sharing setting here`".
### (2-B) In SmartConsole
Show / Hide this section
> Notes:
>
> * On a Multi-Domain Security Management Server, you must configure the applicable value for the consent flags also in the Global Domain (in addition to the applicable Domain Management Servers).
> * On a Multi-Domain Log Server, you must configure the applicable value for the consent flags also in the Global Domain (in addition to the applicable Domain Log Servers).
>
> Instructions:
>
> 1. In SmartConsole top left corner, click the **Menu** button.
>
> 2. Click **Global properties**.
>
> 3. In the left panel, click **Data Access Control**.
>
> 4. Configure the required Consent Flags.
>
> |-----------------------|------------------------------------------------------------------------------------------------------------------------------|
> | Consent Flag | Title of the Checkbox in SmartConsole |
> | Download Security | Automatically download and install Software Blade Contracts, security updates, and other important data (highly recommended) |
> | Download Non-Security | Automatically download software updates and new features (highly recommended) |
> | Upload Information | Help Check Point improve the products by sending anonymous information |
> | Upload Crash Data | I approve sharing core dump files and other relevant crash data which might contain personal information |
>
> 
> 5. Click **OK**.
>
> 6. Install the Access Control Policy on all managed Security Gateways / Clusters / VSX Virtual Systems / VSX Virtual Routers.
### (2-C) In Gaia Clish (local override)
Show / Hide this section
> To configure the local values:
> > Enter the string to filter this table:
> >
> > |-----------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
> > | Consent Flag | Gaia Clish Command |
> > | Download Security | * To override the value configured in SmartConsole: `set consent-flags allow-receiving-data {true | false}` * To use the value configured in SmartConsole: `set consent-flags allow-receiving-data use-mgmt-settings` |
> > | Download Non-Security | * To override the value configured in SmartConsole: `set consent-flags allow-receiving-data-non-security {true | false}` * To use the value configured in SmartConsole: `set consent-flags allow-receiving-data-non-security use-mgmt-settings` |
> > | Upload Information | * To override the value configured in SmartConsole: `set consent-flags allow-sending-data {true | false}` * To use the value configured in SmartConsole: `set consent-flags allow-sending-data use-mgmt-settings` |
> > | Upload Crash Data | * To override the value configured in SmartConsole: `set consent-flags allow-sending-crash-data {true | false}` * To use the value configured in SmartConsole: `set consent-flags allow-sending-crash-data use-mgmt-settings` |
>
> > {#Unique_ID2C_confTable}
>
> To view the current local values:
> > Enter the string to filter this table:
> >
> > |-----------------------|--------------------------------------------------------|-----------------------------------------------------|
> > | Consent Flag | Gaia Clish Command | Expert Mode Command |
> > | Download Security | `show consent-flags allow-receiving-data` | `dbset AllowReceivingDataFromCheckPoint` |
> > | Download Non-Security | `show consent-flags allow-receiving-data-non-security` | `dbset AllowReceivingDataFromCheckPointNonSecurity` |
> > | Upload Information | `show consent-flags allow-sending-data` | `dbset AllowSendingDataToCheckPoint` |
> > | Upload Crash Data | `show consent-flags allow-sending-crash-data` | `dbset AllowSendingSensitiveDataToCheckPoint` |
> > {#Unique_ID2C_viewTable}
### (2-D) Priority Order of Consent Flag Values
Show / Hide this section
>
> |-----------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
> | Server | Priority Order |
> | Management Server | 1. The Consent Flag values you configured in the Gaia First Time Configuration Wizard are valid only until the first "Install Database" operation. 2. The Consent Flag values you configured locally (in Gaia Clish) on the Management Server take priority. |
> | Security Gateway / Cluster Member | 1. The Consent Flag values you configured in the Gaia First Time Configuration Wizard are valid only until the first policy installation. 2. After the first policy installation, the Consent Flag values you configured in SmartConsole take priority. 3. The Consent Flag values you configured locally (in Gaia Clish) on the Security Gateway / Cluster Member take priority. |
(3) Consent Flag Decision Table {#Consent Flag Decision Table}
--------------------------------------------------------------
The tables below show the final verdict - whether a download / upload is allowed or forbidden.
This final verdict is based on the values of a Consent Flag in different database, that have different priorities.
### (3-A) Management Server R81.20 and higher
> Show / Hide this section
> > Enter the string to filter this table:
> >
> > |-------|---------------------------------------------------------------------------|------------------------------------------------------------------------------------------|-----------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
> > | Row # | Consent Flag initial value from the Gaia OS FTCW on the Management Server | Consent Flag value in the Management Database on the Management Server (in SmartConsole) | Final Verdict - Ability to download / upload on the Management Server | How is this configuration possible? |
> > | 1 | 0 | true | 1 - Management Server is allowed to download / upload. | Not possible - after the Gaia OS FTCW, the initial values in the Gaia OS Database always match the values in the Management Database. |
> > | 2 | 1 | true | 1 - Management Server is allowed to download / upload. | 1. An administrator manually enabled the Consent Flag during the Gaia FTCW. 2. An administrator manually enabled the Consent Flag in SmartConsole. 3. An administrator performed the "Install Database" or the "Install Policy" operation. |
> > | 3 | 0 | false | 0 - Management Server is forbidden to download / upload. | 1. An administrator manually disabled the Consent Flag during the Gaia FTCW. 2. An administrator manually disabled the Consent Flag in SmartConsole. 3. An administrator performed the "Install Database" or the "Install Policy" operation. |
> > | 4 | 1 | false | 0 - Management Server is forbidden to download / upload. | Not possible - after the Gaia OS FTCW, the initial values in the Gaia OS Database always match the values in the Management Database. |
> > {#Unique_ID3ATable}
### (3-B) Security Gateway R81.20 (or higher) managed by Management Server R81.20 (or higher)
> Show / Hide this section
> > The final verdict in the table below is based on configuration in Gaia OS FTCW and in SmartConsole.
> >
> > You can change the Consent Flag values **locally** on the Security Gateway / Cluster Member.
> >
> > Enter the string to filter this table:
> >
> > |-------|--------------------------------------------------------------------------|------------------------------------------------------------------------------------------|--------------------------------------------------------------------|----------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
> > | Row # | Consent Flag initial value from the Gaia OS FTCW on the Security Gateway | Consent Flag value in the Management Database on the Management Server (in SmartConsole) | Consent Flag value in the Objects Database on the Security Gateway | Final Verdict - Ability to download / upload on the Security Gateway | How is this configuration possible? |
> > | 1 | 1 | true | false | 1 - Security Gateway is allowed to download / upload. | Not possible. This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members. |
> > | 2 | 0 | false | true | 0 - Security Gateway is forbidden to download / upload. | Not possible. This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members. |
> > | 3 | 1 | true | true | 1 - Security Gateway is allowed to download / upload. | * Before the first policy installation - Security Gateway is allowed to download / upload. * After the first policy installation - Security Gateway is allowed to download / upload. |
> > | 4 | 0 | true | true | 1 - Security Gateway is allowed to download / upload. | * Before the first policy installation - Security Gateway is forbidden to download / upload. * After the first policy installation - Security Gateway is allowed to download / upload. |
> > | 5 | 1 | false | false | 0 - Security Gateway is forbidden to download / upload. | * Before the first policy installation - Security Gateway is allowed to download / upload. * After the first policy installation - Security Gateway is forbidden to download / upload. |
> > | 6 | 0 | false | false | 0 - Security Gateway is forbidden to download / upload. | * Before the first policy installation - Security Gateway is forbidden to download / upload. * After the first policy installation - Security Gateway is forbidden to download / upload. |
> > | 7 | 1 | false | true | 1 - Security Gateway is allowed to download / upload. | Not possible. This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members. |
> > | 8 | 0 | false | true | 0 - Security Gateway is forbidden to download / upload. | Not possible. This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members. |
> > {#Unique_ID3BTable}
### (3-C) Security Gateway R81.20 (or higher) managed by Management Server R81.10 / R81
> Show / Hide this section
> > Notes:
> >
> > * For the supported forward compatibility, see [sk113113](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113113) - section "Management Servers and Security Gateways they can manage".
> >
> > * Management Server R81.10 / R81 supports only these Consent Flags:
> >
> > * "Allow Upload" - Allows the upload of data from the machine to Check Point.
> >
> > * "Allow Download" - Allows the download of data from Check Point to the Management Server.
> >
> > * The final verdict in the table below is based on configuration in Gaia OS FTCW and in SmartConsole.
> >
> > You can change the Consent Flag values **locally** on the Security Gateway / Cluster Member.
> >
> > Enter the string to filter this table:
> >
> > |-------|---------------------------------------------------------------------------------------|----------------------------------------------------------------------|--------------------------------------------------------------------|----------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
> > | Row # | Consent Flag value in the Management Database on the Management Server (SmartConsole) | Consent Flag value in the Registry Database on the Management Server | Consent Flag value in the Objects Database on the Security Gateway | Final Verdict - Ability to download / upload on the Security Gateway | How is this configuration possible? | Comments |
> > | 1 | false | 0 | false | 0 - Security Gateway is forbidden to download / upload. | * On the Security Gateway and on the Management Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later), and in the Objects Database. | Consent Flags on the Security Gateway are disabled. Consent Flags on the Management Server have priority. |
> > | 2 | false | 0 | false | 0 - Security Gateway is forbidden to download / upload. | * On the Security Gateway: An administrator manually disabled the Consent Flags in the Objects Database. * On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). | Consent Flags on the Management Server have priority. |
> > | 3 | false | 0 | true | Not possible. | * On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). * On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). | This scenario can be only temporary because once policy installation is performed, the Security Management Server transfers its configuration information to the Security Gateway. |
> > | 4 | false | 0 | true | Not possible. | * On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). | This scenario can be only temporary because once policy installation is performed, the Security Management Server transfers its configuration information to the Security Gateway. |
> > | 5 | false | 1 | false | 0 - Security Gateway is forbidden to download / upload. | * On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later), and in the Objects Database. * On the Management Server / Log Server: An administrator manually disabled the Consent Flags in the Objects Database. | Consent Flags on the Management Server have priority. |
> > | 6 | false | 1 | false | 0 - Security Gateway is forbidden to download / upload. | * On the Security Gateway and on the Management Server: An administrator manually disabled the Consent Flags in the Objects Database. | Consent Flags on the Management Server have priority. |
> > | 7 | false | 1 | true | Not possible. | * On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). * On the Management Server / Log Server: An administrator manually disabled the Consent Flags in the Objects Database. | This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members. |
> > | 8 | false | 1 | true | Not possible. | * On the Management Server / Log Server: An administrator manually disabled the Consent Flags in the Objects Database. | This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members. |
> > | 9 | true | 0 | false | 0 - Security Gateway is forbidden to download / upload. | * On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). * On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). | Consent Flags on the Security Gateway are disabled. Consent Flags on the Management Server have priority. |
> > | 10 | true | 0 | false | Not possible. | * On the Security Gateway: An administrator manually disabled the Consent Flags in the Objects Database. * On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). | This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members. |
> > | 11 | true | 0 | true | 1 - Security Gateway is allowed to download / upload. | * On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). * On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). | Consent Flags on the Management Server have priority. |
> > | 12 | true | 0 | true | 1 - Security Gateway is allowed to download / upload. | * On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). | Consent Flags on the Management Server have priority. |
> > | 13 | true | 1 | false | 0 - Security Gateway is forbidden to download / upload. | * On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later), and in the Objects Database. | Consent Flags on the Security Gateway are disabled. Consent Flags on the Management Server have priority. |
> > | 14 | true | 1 | false | Not possible. | * On the Security Gateway: An administrator manually disabled the Consent Flags in the Objects Database. | Consent Flags on the Management Server have priority. This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members. |
> > | 15 | true | 1 | true | 1 - Security Gateway is allowed to download / upload. | * On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). | Consent Flags on the Management Server have priority. |
> > | 16 | true | 1 | true | 1 - Security Gateway is allowed to download / upload. | * On the Security Gateway and on the Management Server: Both flags are enabled in the Registry, and in the Objects Database. | Consent Flags on the Management Server have priority. |
> > {#Unique_ID3CTable}
### (3-D) Security Gateway R81.10 (or lower) managed by Management Server R81.20 (or higher)
> Show / Hide this section
> > Notes:
> >
> > * For the supported backward compatibility, see [sk113113](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk113113) - section "Management Servers and Security Gateways they can manage".
> >
> > * Security Gateway R81.10 and lower supports only these Consent Flags:
> >
> > * "Allow Upload" - Allows the upload of data from the machine to Check Point.
> >
> > * "Allow Download" - Allows the download of data from Check Point to the Security Gateway.
> >
> > * The final verdict in the table below is based on configuration in Gaia OS FTCW and in SmartConsole.
> >
> > You can change the Consent Flag values **locally** on the Security Gateway / Cluster Member.
> >
> > Enter the string to filter this table:
> >
> > |-------|---------------------------------------------------------------------------------------|--------------------------------------------------------------------|---------------------------------------------------------------------|----------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
> > | Row # | Consent Flag value in the Management Database on the Management Server (SmartConsole) | Consent Flag value in the Objects Database on the Security Gateway | Consent Flag value in the Registry Database on the Security Gateway | Final Verdict - Ability to download / upload on the Security Gateway | How is this configuration possible? | Comments |
> > | 1 | false | false | 0 | 0 - Security Gateway is forbidden to download / upload. | * On the Security Gateway and on the Management Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later), and in the Objects Database. | Consent Flags on the Security Gateway are disabled. Consent Flags on the Management Server have priority. |
> > | 2 | false | false | 1 | 0 - Security Gateway is forbidden to download / upload. | * On the Security Gateway: An administrator manually disabled the Consent Flags in the Objects Database. * On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). | Consent Flags on the Management Server have priority. |
> > | 3 | false | true | 0 | Not possible. | * On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). * On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). | This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members. |
> > | 4 | false | true | 1 | Not possible. | * On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). | This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members. |
> > | 5 | false | false | 0 | 0 - Security Gateway is forbidden to download / upload. | * On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later), and in the Objects Database. * On the Management Server / Log Server: An administrator manually disabled the Consent Flags in the Objects Database. | Consent Flags on the Management Server have priority. |
> > | 6 | false | false | 1 | 0 - Security Gateway is forbidden to download / upload. | * On the Security Gateway and on the Management Server: An administrator manually disabled the Consent Flags in the Objects Database. | Consent Flags on the Management Server have priority. |
> > | 7 | false | true | 0 | Not possible. | * On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). * On the Management Server / Log Server: An administrator manually disabled the Consent Flags in the Objects Database. | This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members. |
> > | 8 | false | true | 1 | Not possible. | * On the Management Server / Log Server: An administrator manually disabled the Consent Flags in the Objects Database. | This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members. |
> > | 9 | true | false | 0 | 0 - Security Gateway is forbidden to download / upload. | * On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). * On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). | Consent Flags on the Security Gateway are disabled. Consent Flags on the Management Server have priority. |
> > | 10 | true | false | 1 | Not possible. | * On the Security Gateway: An administrator manually disabled the Consent Flags in the Objects Database. * On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). | This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members. |
> > | 11 | true | true | 0 | 1 - Security Gateway is allowed to download / upload. | * On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). * On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). | Consent Flags on the Management Server have priority. |
> > | 12 | true | true | 1 | 1 - Security Gateway is allowed to download / upload. | * On the Management Server / Log Server: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). | Consent Flags on the Management Server have priority. |
> > | 13 | true | false | 0 | 0 - Security Gateway is forbidden to download / upload. | * On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later), and in the Objects Database. | Consent Flags on the Security Gateway are disabled. Consent Flags on the Management Server have priority. |
> > | 14 | true | false | 1 | Not possible. | * On the Security Gateway: An administrator manually disabled the Consent Flags in the Objects Database. | Consent Flags on the Management Server have priority. This scenario can be only temporary because during the first policy installation, the Management Server transfers its configuration to the Security Gateway / Cluster Members. |
> > | 15 | true | true | 0 | 1 - Security Gateway is allowed to download / upload. | * On the Security Gateway: An administrator manually disabled both Consent Flags in the Registry (either during Gaia FTCW, or later). | Consent Flags on the Management Server have priority. |
> > | 16 | true | true | 1 | 1 - Security Gateway is allowed to download / upload. | * On the Security Gateway and on the Management Server: Both flags are enabled in the Registry, and in the Objects Database. | Consent Flags on the Management Server have priority. |
> > {#Unique_ID3DTable}
(4) Where the Consent Flags are Stored {#Where the Consent Flags are Stored}
----------------------------------------------------------------------------
Show / Hide this section
> Enter the string to filter this table:
>
> |--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
> | Where the Consent Flags are stored? | When the Consent Flags are created? | Comments |
> | `$FWDIR/conf/objects_5_0.C` (Objects Database) | * On a Security Gateway / Cluster Member, during the first policy installation. * On a Security Management Server / Multi-Domain Security Management Server / Domain Management Server / Log Server, during the first "Install Database" operation. | * Do **not** edit this file in a text editor. You must use only SmartConsole, Database Tool (GuiDBedit Tool, [sk13009](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk13009)), or dbedit tool ([skI3301](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=skI3301)). * The Consent Flag values are stored in the ***firewall_properties*** section of this *objects_5_0.C* file. * The Consent Flag values are stored in these parameters: |-----------------------|----------------------------------------------| | Consent Flag | Parameter Name | | Download Security | `:allow_download_content (...)` | | Download Non-Security | `:allow_download_non_security_content (...)` | | Upload Information | `:allow_upload_content (...)` | | Upload Crash Data | `:allow_upload_sensitive_content (...)` | * To see the current Consent Flag values, run in the Expert mode: `grep -n -E "allow_download_|allow_upload_" $FWDIR/conf/objects_5_0.C` Possible returned values: * `:<`*Parameter_Name*`> (false)` - download / upload of data is forbidden * `:<`*Parameter_Name*`> (true)` - download / upload of data is allowed |
> | `/config/db/initial` (Gaia OS Database) | * On a Security Gateway / Cluster Members / Security Management Server / Multi-Domain Security Management Server / Domain Management Server / Log Server, during the First Time Configuration Wizard. * On a Security Management Server / Multi-Domain Security Management Server / Domain Management Server / Log Server, during the first "Install Database" operation. * On a Security Gateway / Cluster Member, when an administrator overrides the central Consent Flag values with the Gaia Clish commands. | * Do **not** edit this file in a text editor. You must use only the Gaia Clish commands "`set consent-flags`". * The Consent Flag values are stored in these parameters: |-----------------------|----------------------------------------------------------------------------------------------------| | Consent Flag | Parameter Name | | Download Security | `AllowReceivingDataFromCheckPoint` `AllowReceivingDataFromCheckPointDefault` | | Download Non-Security | `AllowReceivingDataFromCheckPointNonSecurity` `AllowReceivingDataFromCheckPointNonSecurityDefault` | | Upload Information | `AllowSendingDataToCheckPoint` `AllowSendingDataToCheckPointDefault` | | Upload Crash Data | `AllowSendingSensitiveDataToCheckPoint` `AllowSendingSensitiveDataToCheckPointDefault` | **Note** - Parameters with the names that end with "`...Default`" contain the Consent Flag values received from the Gaia First Time Configuration Wizard. Gaia OS uses these values before the first policy installation or before the local override with the Gaia Clish "`set consent-flags`" commands. * To see the current Consent Flag values in Gaia Clish, run these commands: * `show consent-flags allow-receiving-data` * `show consent-flags allow-receiving-data-non-security` * `show consent-flags allow-sending-crash-data` * `show consent-flags allow-sending-data` * To see the current Consent Flag values in the Expert mode, run one of these commands: * `grep -n -E "AllowSending|AllowReceiving" /config/db/initial` > Possible returned values: > * `:<`*Parameter_Name*`> 0` - download / upload of data is forbidden > * `:<`*Parameter_Name*`> 1` - download / upload of data is allowed * `dbget <`*Parameter_Name*`>` > Examples: > * `dbget AllowReceivingDataFromCheckPoint` > * `dbget AllowReceivingDataFromCheckPointNonSecurity` > * `dbget AllowSendingDataToCheckPoint` > * `dbget AllowSendingSensitiveDataToCheckPoint` > Possible returned values: > * `0` - download / upload of data is forbidden > * `1` - download / upload of data is allowed |
> | On a Security Gateway / Cluster Member / Security Management Server / Log Server: `$CPDIR/tmp/umis_objects.C` On a Multi-Domain Security Management Server: `$MDSDIR/conf/objects_5_0.C` (Internal Database) | * During the initial start of a Security Gateway / Cluster Member, the `fwd` process configures the default values in this file. * On a Security Gateway / Cluster Member, during a policy installation. * On a Security Management Server / Multi-Domain Security Management Server / Domain Management Server / Log Server, during the first "Install Database" operation. | * The FWD daemon creates this internal database based on the information in the Gaia OS Database or based on the central values from the policy installation. * Do **not** edit this file in a text editor. This file is updated automatically during: * Each start of the FWD daemon * Each policy installation * Each database installation operation * The Consent Flag values are stored in the "`DownloadAccess`" section in these parameters: |-----------------------|----------------------------------------------| | Consent Flag | Parameter Name | | Download Security | `:allow_download_content (...)` | | Download Non-Security | `:allow_download_non_security_content (...)` | | Upload Information | `:allow_upload_content (...)` | | Upload Crash Data | `:allow_upload_sensitive_content (...)` | * To see the current Consent Flag values in the Expert mode, run: `grep -A 10 DownloadAccess $CPDIR/tmp/umis_objects.C | grep ':allow'` > Possible returned values: > * `:<`*Parameter_Name*`> (false)` - download / upload of data is forbidden > * `:<`*Parameter_Name*`> (true)` - download / upload of data is allowed |
> {#Unique_ID4Table}
(5) Known Limitations and Warnings {#Known Limitations and Warnings}
--------------------------------------------------------------------
Show / Hide this section
> * On a Management Server, after the Gaia First Time Configuration Wizard, it takes a few minutes for the CPM process to start.
>
> * On a Management Server, before the first "Install Database" operation, it is possible to override the local Consent Flag values with the Gaia Clish commands "`set consent-flags`".
>
> After the first "Install Database" operation or "Install Policy" operation, the values configured in SmartConsole (Global Properties \> Data Control Access) take priority.
(6) Troubleshooting {#Troubleshooting}
--------------------------------------
Show / Hide this section
>
> |---|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-----------------------------------------------------------------|------------------------------------------------------------------------------------------|
> | # | Symptoms | Explanation | Next Step |
> | 1 | 1. Gaia Portal \> CPUSE page shows this message when you search for a package by its CPUSE Identifier: *No package was found Enter full and correct package name* 2. The */opt/CPInstLog/DeploymentAgent.log* file contains this line for the time of the issue: *currently installed license is not entitled to receive updates from CheckPoint download center. FDT error: EntitlementEJB:doProductEntitlement() User Product Entitlement Failure* | The current license is expired or not sufficient | Install the correct license |
> | 2 | 1. Gaia Portal \> CPUSE page shows this message when you search for a package by its CPUSE Identifier: *Download operation isn't approved by the user. Please check your configuration* 2. The */opt/CPInstLog/DeploymentAgent.log* file contains this line for the time of the issue: *\[HIGH MSG_DOWNLOADS_NOT_AUTHORIZED\]: The administrator did not authorize downloads, not performing update* | The administrator disabled the Consent Flag "Download Security" | Enable this Consent Flag to download the "Security" data from online Check Point servers |
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content