> Source: [sk177163](https://support.checkpoint.com/results/sk/sk177163)

# sk177163 - Security Gateways log locally after an upgrade

| Property | Value |
|----------|-------|
| Solution ID | sk177163 |
| Date Created | 2022-01-03 |
| Last Modified | 2025-05-23 |
| Technical Level | Advanced |
| Products | Security Gateway, Security Management Server |
| Versions | R81.20, R81.10 (EOS), R81.20, R81 (EOS), R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Security Gateways log locally after an upgrade

* The Log Server does not show logs.

* netstat on Security Gateway shows Time_wait on 257:

  ```
  
  [Expert@gw-xxxxxx:x]# netstat -nap | grep 257
  tcp        0      0 0.0.0.0:257                 0.0.0.0:*                   LISTEN      31161/fwd         
  tcp        0      0 172.24.32.62:53120          172.24.32.91:257            TIME_WAIT   -  
  ```

  ![](https://sc1.checkpoint.com/sc//SolutionsStatics/sk177163/Untitled202201041205381.png)
* telnet /ping to the Log Server operates correctly.

* fwd debugs show:

  ```
  
  [FWD ...]@HostName[Date Time] call_handlers_list: no conversion done, set CN=onchecklog01,O=blackterra..pyf6wc as sic name
  [FWD ...]@HostName[Date Time] PM_session_init: given session O(CN=blacktiger-a,O=blackterra..pyf6wc;CN=onchecklog01,O=blackterra..pyf6wc;257;log).
  [FWD ...]@HostName[Date Time] PM_policy_query: input session O(CN=blacktiger-a,O=blackterra..pyf6wc;CN=onchecklog01,O=blackterra..pyf6wc;257;log).
  [FWD ...]@HostName[Date Time] PM_policy_query: rule found (ANY;Log_Server;ANY;log;sslca(1/1)).
  [FWD ...]@HostName[Date Time] PM_policy_query: finished successfully. 1st method = sslca
  [FWD ...]@HostName[Date Time] PM_method_choose: did not find policy method.
  [FWD ...]@HostName[Date Time] client method name sslca, server method name deny
  [FWD ...]@HostName[Date Time] PM_policy_choose: finished successfully. choose: DENY.
  [FWD ...]@HostName[Date Time] policy_choose: choose failed.
  [FWD ...]@HostName[Date Time] sic_client_negotiate_auth_method: policy choose failed.
  [FWD ...]@HostName[Date Time] fwasync_do_mux_in: 365: handler returned with error
  [FWD ...]@HostName[Date Time] sic_client_end_handler: for conn id = 365
  [FWD ...]@HostName[Date Time] fwclient_connected: SIC Error for log: Client could not choose an authentication method for service log
  [FWD ...]@HostName[Date Time] fwclient_connected: connection failed
  [FWD ...]@HostName[Date Time] log_connected: connect to '10.176.69.87' failed
  [FWD ...]@HostName[Date Time] 07:06:27: srv_disconnected: change 10.176.69.87 status to Status ERROR description: Log-Server Disconnected
  ```

* telnet works with port 257 for Management/Log Server IP

## Cause

* Configuration issue: Review the configuration on SmartConsole and look for multiple primary Log Server objects.   

* The R81 Security Gateway is trying to forward logs to a Log Server of a lower version, resulting in compatibility issues. Security Gateways of version R81 and above can be managed only by Security Management Servers of version R81 and above. Refer to the [Check Point R7X, R80.X and R81 Backward Compatibility Map](http://supportcontent.checkpoint.com/documentation_download?ID=24179).

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content