> Source: [sk180481](https://support.checkpoint.com/results/sk/sk180481)

# sk180481 -  Security Group Member (SGM) in a VSX environment is in a boot loop and stays in the DOWN state

| Property | Value |
|----------|-------|
| Solution ID | sk180481 |
| Date Created | 2023-01-09 |
| Last Modified | 2023-01-09 |
| Technical Level | General |
| Products | Scalable Platforms |
| Versions | R81.10 (EOS), R81 (EOS) |

## Symptoms

- * An SGM in a VSX environment is in a boot loop and stays in the DOWN state after five reboot attempts.

* The output of the `cphaprob list` command shows that the active pnote "configuration" is in a "problem" state:  
  `Configuration`  
  `Registration number: 10`  
  `Timeout: none`  
  `Current state: problem`  
  `Time since last report: 41229 sec`

  <br />

* The output of the `$FWDIR/log/blade_config` command shows these errors:  
  `>>> Executing post-copy command of /etc/wrp_bfm_id (eval exec /bin/false)`  
  `child process exited abnormally`  
  `>>> End of eval exec /bin/false`  
  `>>> Command result (1) indicating a reboot is needed! `

  <br />

## Cause

Removing a Warp interface may fail on one member, which creates a mismatch between the cluster members database because the Warp interface remains on other members.

<br />

## Solution

This problem was fixed. The fix is included starting from:

* [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 79
* [Jumbo Hotfix Accumulator for R81](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm) starting from Take 77
* [Integrated into R81.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk173903)

To fix the issue itself, do this procedure:

### **Identify the Issue**

**Important**: Do these steps on all SGMs in the Security Group.

1. Connect to the terminal on the Security Group.  

2. Look for the remaining wrp or wrpj interface in the */config/active* file:  
   `grep 'wrp' /config/active | grep 'instance'`  

3. Compare the list of Warp interfaces with the interfaces in:  
   */etc/wrp_bfm_id*   
   **and**   
   *# netns ifaces all \| grep wrp*   

4. If the interface is in */config/active* but not in *netns ifaces all* and *wrp_bfm_id* , then this is the leftover interface. Remove it manually.  
   **Notes** :  
   Validate the configuration. Refer to the "Important Notes" section below.  
   By design, the wrp_bfm_id file contains only wrp interfaces, not wrpj interfaces.

> **Example** :  
> `cat /etc/wrp_bfm_id`  
> `wrp640=200278016`  
> `wrp448=200282113`  
>
> grep 'wrp' /config/active \| grep 'instance'  
> **interface:wrpj513:instance 0**  
> *interface:wrp448:instance 7*  
> *interface:wrpj448:instance 1*  
> *interface:wrp640:instance 10*  
> *`interface:wrpj640:instance 1`*The outputs above show wrpj513, not wrp513. This means that wrpj513 is the remaining interface because wrp513 is not in the database.

### **Validation**

Make sure this is the leftover interface:

1. Open the applicable VS object in SmartConsole and make sure that the interface is not below the **Topology** tab.  

2. Make sure that the leftover interface is not in the*local.vsall* file of the VSX in the Security Management Server:  
   `[Expert@Mgmt]# grep '<suspected interface>' $FWDIR/state/<VSX_name>/VSX/local.vsall`  
   **Example** :  
   `[Expert@Mgmt]# grep 'wrp513' /opt/CPsuite-R81.10/fw1/state/VSX22/VSX/local.vsall`  

3. Make sure that the leftover interface is not in the output of the `vsx_util show_interfaces` command.  

4. Make sure that the leftover interface is not in the output of the `fw vsx showncs` command on the SMO:  
   `SMO # fw vsx showncs <vsid>`

### Remove the Leftover Interface

To resolve the issue, you must manually delete all lines containing the leftover interface from the Gaia database. For more information, refer to [sk92770](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92770).  

**Example** :

1. Find all lines contacting wrp513 in */config/active* :
   * `[Expert@admin]# grep -E 'wrp513|wrpj513' /config/active`  
     `interface:wrpj513:state off`  
     `interface:wrpj513:instance 0`  

2. Remove all the entries above from all SGMs:
   1. `[Expert@admin]#dbset interface:wrpj513:state`
   2. `[Expert@admin]#dbset interface:wrpj513:instance`
   3. `[Expert@admin]#dbset :save`

**Important Notes:**

* For each WRP interface, there must be a corresponding WRPJ interface, and vice versa.  

* All configured WRP interfaces must be in the management database and the VSX Network Configuration Scripts (NCS).  

* The*wrp_bfm_id* file must contain all WRP interfaces listed in the */config/active* file.  

* All WRP and WRPJ interfaces listed in the output of the `netns iface all` command must be in the *wrp_bfm_id* file.  

* All WRP and WRPJ interfaces listed in the output of the `netns iface all` command must be in the */config/active* file, and vice versa.

If one or more of these conditions are not met, there may be an issue.

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content