> Source: [sk178045](https://support.checkpoint.com/results/sk/sk178045) # sk178045 - During an upgrade of a Security Group, the action "Fetching the policy from the Management Server and installing it" fails on the upgraded Security Group Members | Property | Value | |----------|-------| | Solution ID | sk178045 | | Date Created | 2022-02-24 | | Last Modified | 2024-11-25 | | Technical Level | General | | Products | Scalable Platforms | | Versions | R81.20, R81.10 (EOS), R81 (EOS) | | OS | Gaia | ## Symptoms - During an upgrade of a Security Group to R81.10 / R81.20, the action "Fetching the policy from the Management Server and installing it" fails on the upgraded R81.10 / R81.20 Security Group Members. ## Solution ### Introduction This article describes different scenarios when during a CPUSE upgrade of a Security Group in the Maestro configuration or on a Scalable Chassis, the output of the "`sp_upgrade`" script shows that the procedure "*Fetching the policy from the Management Server and installing it*" fails on the upgraded Security Group Members. Each Scenario has its own cause and solution. See the Table of Contents below. **Table of Contents:** * Maestro Dual Site with Sync ports connected through a switch * LACP (802.3ad) Bond between the Management Server and the Maestro Orchestrator / Scalable Chassis * Related documents Show the Entire Article ### 1. Maestro Dual Site with Sync ports connected through a switch {#Scenario 1} **Symptoms:** 1. A Maestro Dual Site environment is upgraded from R80.20SP or from R80.30SP to R81.10 / R81.20. 2. The two sites are not directly connected. A switch connects the 'site-sync' ports on the sites. 3. The output of the "`sp_upgrade`" script shows that the procedure "*Fetching the policy from the Management Server and installing it*" fails on the upgraded R81.10 / R81.20 Security Group Members. Show / Hide solution **Additional Symptoms:** * The reason for the policy installation failure is: *TCP connectivity failure ( port = 18191 )( IP = \ )\[ error no. 10 \]. Policy Fetch Failed* * As the upgraded site initiates a connection, the reply reaches the active site and is forwarded to the upgraded site over the Sync interface (by design). * Traffic capture confirms that the forwarded traffic does not reach the upgraded site. **Issue:** * PRJ-37217, PMTR-80218 **Cause:** > In R80.20SP and R80.30SP, site correction occurs on the same interface from which the corrected traffic arrives. > > Starting in R81.10, the corrected packet is forwarded over the Sync interface to destination IP **0.0.0.0**. > > The switch between the sites might drop this. > > For an example of a corrected packet from member 1_1 to member 2_1: > > `00:00:00:00:c2:00 > 00:1c:7f:0f:04:fe, ethertype IPv4 (0x0800), length 128: 172.16.6.65.8116 > 0.0.0.0.8116: UDP, length 86` **Solution:** > This problem was fixed. The fix is included in: > > * [Check Point R81.20 for Scalable Platforms](https://support.checkpoint.com/results/sk/sk177624) > * [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 55 > * [Jumbo Hotfix Accumulator for R81](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm) starting from Take 68 > > If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue. > A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix. > For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case. > > **Hotfix installation instructions:** > Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597). ### 2. LACP (802.3ad) Bond between the Management Server and the Maestro Orchestrator / Scalable Chassis {#Scenario 2} **Symptoms:** 1. The Management Server that manages this Security Group connects to the Maestro Orchestrator / Scalable Chassis through an LACP (802.3ad) bond interface. 2. The output of the "`sp_upgrade`" script shows that the procedure "*Fetching the policy from the Management Server and installing it*" fails on the upgraded R81.10 / R81.20 Security Group Members. Show / Hide solution **Cause:** > Inconsistent LACP (802.3ad) bond attributes between the R81.10 / R81.20 and older versions prevent the upgraded R81.10 / R81.20 Security Group Members from connecting to the Management Server and pulling policy while the active Security Group Members still run the previous version. **Solution:** > Change the bond mode on the Security Group to a mode that is not LACP (802.3ad). > > For instructions, see the [Gaia Administration Guide](https://support.checkpoint.com/product/520#f-commonsource=C.%20Documentation) for your version. > > **Notes:** > > * To minimize traffic impact, make sure to change the bond mode on the Security Group and the external switch simultaneously. > > * If you cannot change the bond mode in the Security Group to "XOR" or "Active-Backup", then [contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/). > A Support Engineer will perform a special procedure to make sure all Security Group Members get the required policy. ### Related Documents {#Related documents} * See the [Maestro Administration Guide](https://support.checkpoint.com/product/520#f-commonsource=C.%20Documentation) for your version * See the [Scalable Chassis Administration Guide](https://support.checkpoint.com/product/493#f-commonsource=C.%20Documentation) for your version * See the [Gaia Administration Guide](https://support.checkpoint.com/product/520#f-commonsource=C.%20Documentation) for your version --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content