> Source: [sk179868](https://support.checkpoint.com/results/sk/sk179868)

# sk179868 - Security Gateways R81 and R81.10 with Identity Awareness disabled drop traffic if NAT rule contains an Access Role object

| Property | Value |
|----------|-------|
| Solution ID | sk179868 |
| Date Created | 2022-08-25 |
| Last Modified | 2022-08-29 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Security Gateway R81 or R81.10 drops traffic in this scenario:

  1. The Identity Awareness Software Blade is disabled on the Security Gateway
  2. There is a Manual NAT rule that contains an Access Role object
  3. You install the Access Control policy with this NAT rule on the same Security Gateway that has Identity Awareness Software Blade disabled
* The *$FWDIR/log/fwk.elg* and */var/log/messages* files contain these lines:

  *nrb_column_ip_match: idapi_create_handle failed
  nrb_rulebase_default_match: virtual match_func failed for column 'XXX'
  fw_nrb_rb_nat_match: virtual rb_match_func failed
  fw_xlate_match: nrb_rulebase_nat_get_matched_rules failed*

## Cause

Starting in the R81 version, NAT policy supports Access Role objects on Security Gateways with the enabled Identity Awareness Software Blade.

The Management Server installs this NAT rule also on Security Gateways that have the Identity Awareness Software Blade disabled. As a result, these Security Gateways might experience internal errors and might drop traffic.

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, collect [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) files from the Management Server and Security Gateways / Cluster Members involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).

As an immediate **workaround** , use **one of these options**:

* In the NAT rules, replace the Access Role objects with IP-based objects and install the Access Control policy in SmartConsole.

* Delete the NAT rules with the Access Role objects and install the Access Control policy in SmartConsole.

* Enable and configure the Identity Awareness Software Blade in the problematic Security Gateway object and install the Access Control policy in SmartConsole.

Note - If the installation of the Access Control policy fails on the problematic Security Gateway / Cluster:

1. Connect to the problematic Security Gateway / each Cluster Member **through the console port**.

2. Log in to the Expert mode.

3. Back up the current policy files:

   `cd $FWDIR/state/local/`

   `tar cvf /var/log/FW1_Policy_Bkp.tar FW1`
4. Remove the current policy files:

   `rm $FWDIR/state/local/FW1/*`
5. Generate the default Check Point policy called "Initial Policy" (it allows only Check Point internal communication):

   `comp_init_policy`
6. Load the "Initial Policy":

   `fw fetch local`
7. Make sure the "Initial Policy" is loaded:

   `cpstat -f policy fw | head -n 3`
8. In SmartConsole, install the Access Control policy on the problematic Security Gateway / Cluster.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content