> Source: [sk182964](https://support.checkpoint.com/results/sk/sk182964)

# sk182964 - "Error: Internal system error in HTTPS Inspection (Error Code: 1)" caused by Identity Awareness

| Property | Value |
|----------|-------|
| Solution ID | sk182964 |
| Date Created | 2025-01-15 |
| Last Modified | 2025-08-06 |
| Technical Level | Advanced |
| Products | Security Gateway, Scalable Platforms |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R82.10, R82, R81.20, R81.10 (EOS) |

## Symptoms

- * The firewall uses load sharing mechanism. This is relevant for ClusterXL load sharing and Maestro.
* The https inspection stops working on some of the members with the following error: `Internal system error in HTTPS Inspection (Error Code: 1)`
* Rebooting the member with the errors temporarily resolves the issue.
* IDAPI errors are found in `fwk.elg`:
  * `[ERROR]: idapi_load_data_impl: session id 20db5a07 not found in client_db, although ip 192.168.0.1 was assigned to it`
  * `[ERROR]: nrb_column_ip_match: idapi_get_roles_side returned ERROR`
  * `[ERROR]: nrb_rulebase_default_match: virtual match_func failed for column 'Source IP' (1)`
  * `[ERROR]: nrb_rb_https_inspection_match: virtual rb_match_func failed`
* Clearing the PDP and PEP tables resolves the issue temporarily.
  * Run the commands either on a maintenance window or after working hours, as all the associations will be cleared and users will have to reauthenticate.
    * Run on all members on ClusterXL LS: `# cat $FWDIR/lib/nac_tables.def | grep dynamic | cut -d ' ' -f1 | awk '{ print ("-t "$0"")}' ORS=" " | awk '{print "fw tab " $0 "-x -y"}' | bash ; fw kill pdpd ; fw kill pepd`
    * Run on one member on Maestro (it will take effect on all members): `# cat $FWDIR/lib/nac_tables.def | grep dynamic | cut -d ' ' -f1 | awk '{ print ("-t "$0"")}' ORS=" " | awk '{print "g_fw tab " $0 "-x -y"}' | bash ; g_fw kill pdpd; g_fw kill pepd`

## Cause

HTTPS Inspection - Internal system error (Error Code: 1) indicates that there is an issue with matching the first packet of the connection against the rulebase.  

In this specific case, the issue occurs from IDAPI (Identity Awareness) module.  

Each member has its own active PDP process that communicates with an Identity source and writes to the IDA kernel tables. Because multiple PDP processes write to the kernel tables at the same time, mismatches can occur in the kernel tables.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content