> Source: [sk183313](https://support.checkpoint.com/results/sk/sk183313) # sk183313 - Policy Insights - Onboarding and Troubleshooting | Property | Value | |----------|-------| | Solution ID | sk183313 | | Date Created | 2025-04-14 | | Last Modified | 2026-09-07 | | Technical Level | General | | Products | Security Management Server, SmartConsole, Multi-Domain Security Management Server | | Versions | R82.10, R82, R81.20, R82.10, R82.10, R82, R81.20, R81.20, R82 | ## Solution Overview -------- Policy Insights helps administrators analyze and optimize the policy Rule Base, by offering detailed insights and visualizations. Based on this information, the Check Point Cloud Services analyze traffic and policies to provide suggestions that tighten the Access Control policy and Threat Prevention Policy. The suggestions are generated periodically, following an internal scheduling. A cleaner and more efficient Rule Base makes it easier to manage the security policies and helps reduce vulnerabilities. Policy Insights is a cloud-based service that integrates with the Security Management Server through: * **Telemetry:** Log Servers collect and send telemetry data to Check Point Cloud Services. * **AI Cloud Engine:** Check Point Cloud-based AI analyzes traffic and policies to provide suggestions for a tighter Rule Base. * **Management API Requests:** mgmt_cli commands / Web API requests to show and apply product capabilities (currently, API is undocumented and subject to change). * **SmartConsole Integration:** Results for access policy insights are displayed in the "**Security Policies** " view \> **Access Control** \> **Policy** . Results for Threat Prevention Policy Insights are displayed in the "**Security Policies** " view \> **Threat Prevention** \> choose the layer. * **Troubleshooting** needs to be conducted when you have problems with Policy Insights (see below). For more information, see the *Security Management Administration Guide* for your version. Onboarding Information ---------------------- Policy Insights functionality is released gradually. The new features and capabilities are updated automatically in the customer's environment. Available starting from: |-----------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Feature | Versions | | Access Policy Insights | * [R82 Jumbo Hotfix Accumulator](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) Take 14 and higher * [R81.20 Jumbo Hotfix Accumulator](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) Take 99 and higher | | Threat Prevention Policy Insights | * R82.10 and higher | If your system is aligned with the above then you should check that the Policy Insights release package is installed, see [sk183421](https://support.checkpoint.com/results/sk/sk183421). Policy Insights functionality depends on the connectivity of your Security Management Server to the Check Point Portal, see [To connect your Security Management Server and Security Gateway objects from SmartConsole to the Check Point Portal](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_SecurityManagement_AdminGuide/Content/Topics-SECMG/Sharing-Configuration-Logs-with-Infinity-Portal.htm#con). Policy Insights must be activated in the "**Integration \&** **Services**" view in SmartConsole. Troubleshooting --------------- > Before any troubleshooting scenario, check that your Management Server meets the pre-requisites for Policy Insights (see cases 1+2 below) > > ### (Scenario 1) Policy Insights cannot be activated from the "Integration \& Services" view in SmartConsole > > ### (Scenario 2) The "Insights" button does not appear in SmartConsole > > **Cause (for both Scenario 1 and Scenario 2):** The Management Server does not meet the prerequisites for the Policy Insights activation. > > * Access Policy Insights: > The Management Server version is lower than [R82 Jumbo Hotfix Accumulator](https://sc1.checkpoint.com/documents/Jumbo_HFA/R82/Default.htm) Take 14 or [R81.20 Jumbo Hotfix Accumulator](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) Take 99. > * Threat Prevention Policy Insights: > The Management Server version is R82 or lower. > * Policy Insights Releases Updates package is not installed, or is not up to date. > * The Management Server is not connected to Infinity Cloud Services. > * Policy Insights status returns "false" or an error. > > **Solution:** > > 1. Connect to the command line on the Management Server. > 2. Log in to the Expert mode. > 3. Make sure the required Jumbo Hotfix Accumulator package is installed: > `cpinfo -y all` > If the Management Server does not meet the requirements, then install the required Jumbo Hotfix Accumulator package (or upgrade to the next required version). > 4. Make sure the required Policy Insights Releases Updates package is installed and its version is up to date: > 1. Run: > `autoupdatercli show json | jq '.products[]|select(."product-name"=="AutonomousFirewall")'` > 2. Check that the latest version is installed: > 1. For the installation status, check the attribute "`package-installed`". > Its value must be "`true`". > 2. For version, check the attribute "`package-version`". > Its value must the latest version available as described in [sk183421](https://support.checkpoint.com/results/sk/sk183421). > 3. In the Policy Insights Releases Updates package is not installed, or its version is not the latest, then install the required package from [sk183421](https://support.checkpoint.com/results/sk/sk183421). > 5. Make sure the Management Server is connected to cloud. > Use one of these ways: > * In SmartConsole, on the left navigation panel, click the "**Integration \& Services** " view. > The status appears at the top. > * Run on your Management Server: > * On a Security Management Server: > `mgmt_cli show-cloud-services` > * On a Multi-Domain Security Management Server: > `mgmt_cli -d show-cloud-services` > > The output must show: > `status: "connected"` > 6. Get the status of the Autonomous Firewall feature. > Run on your Management Server: > * On a Security Management Server: > `mgmt_cli afw-status` > * On a Multi-Domain Security Management Server: > `mgmt_cli -d afw-status` > > Next steps: > 1. The output must show "`enabled=true`". > 2. If the output shows "`enabled=false`", then make sure that the "**Policy Insights** " card in the "**Integration \& Services** " view shows "**ON**" (turn it on if necessary). > 3. To use the Threat Prevention Policy Insights, the output must show the "`tp-api-version`". > 1. If it does not, make sure the Management Server meets the prerequisites for Threat Prevention Policy Insights. > If it does, then contact [Check Point Support](https://www.checkpoint.com/support-services/contact-support/). > 4. If one of these errors appears: > * `Local suggestion engine is unavailable` > * `Communication between management server and local suggestions engine failed` > > follow these steps: > 1. Run on your Management Server: > * On a Security Management Server: > `mgmt_cli afw-status` > * On a Multi-Domain Security Management Server: > `mgmt_cli -d afw-status` > > The output must show "`running=true`". > 2. If the output shows "`running=false`", then run this command and check again: > `afw restart -f` > > ### (Scenario 3) Warning about Log Servers that do not report telemetry information > > **Symptoms:** > > There might be several Log Servers that do not report telemetry information. > Therefore, the generated insights maybe less accurate because the AI engine has only partial data. > > **Cause:** > > 1. Machines without Internet access: > For machines that do not have Internet connectivity, allow access to specific domains to download Automatic Releases Updates and to upload the logs (from "Log Sharing"). > In the SmartConsole \> "**Security Policies** " view \> **Access Control** \> **Policy** , add a rule with the relevant Check Point Services in the "Destination" column. Use the updatable object "**Check Point Services** ". > * For EU region: > * `cloudinfra-gw.portal.checkpoint.com` > * `prod-eu.datatube.checkpoint.com` > * `dtwesteuropeprod1.blob.core.windows.net` > * `dtwesteuropeprod2.blob.core.windows.net` > * `dtwesteuropeprod3.blob.core.windows.net` > * For US region: > * `cloudinfra-gw-us.portal.checkpoint.com` > * `prod-us.datatube.checkpoint.com` > * `dteastus2prod1.blob.core.windows.net` > * `dteastus2prod2.blob.core.windows.net` > * `dteastus2prod3.blob.core.windows.net` > > Example: > ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk183313/cp-services-rule202509101525441.png) > 2. Dedicated Log Server and SmartEvent Server instances that are assigned to a specific Domain are not supported. Multi-Domain Log Servers (MLMs) and Log Server / SmartEvent Server instances that are part of the Security Management environment are supported. > > **Solution:** > > 1. For machines that do not have Internet connectivity, allow access to specific domains to download Automatic Releases Updates and to upload the logs (from "Log Sharing"). > 2. Make sure the specified Log Servers can communicate with the Management Server. > 3. Dismiss the warning if it is acceptable that the presented Log Servers do not report telemetry. > > ### (Scenario 4) "Insights" button / "Insights" tab of a rule in SmartConsole does not show a badge with the Insights number > > **Symptom:** > > Cannot show suggestions > > **Cause:** > > These Management API commands fail: > > * `afw-api` > * `tp-api` > * `show-suggestions-summary` > * `afw-status` > > **Solution:** > > 1. Run on your Management Server: > * For Access Policy Insights: > * On a Security Management Server: > `mgmt_cli show access-layers` > * On a Multi-Domain Security Management Server: > `mgmt_cli -d show access-layers` > * For Threat Prevention Policy Insights: > * On a Security Management Server: > `mgmt_cli show threat-layers` > * On a Multi-Domain Security Management Server: > `mgmt_cli -d show threat-layers` > 2. Copy your layer UID. > 3. Run on your Management Server: > * For Access Policy Insights: > * On a Security Management Server: > `mgmt_cli afw-api` > `mgmt_cli show-suggestions-summary layer ` > * On a Multi-Domain Security Management Server: > `mgmt_cli -d afw-api` > `mgmt_cli -d show-suggestions-summary layer ` > * For Threat Prevention Policy Insights: > * On a Security Management Server: > `mgmt_cli tp-api` > `mgmt_cli show-suggestions-summary layer ` > * On a Multi-Domain Security Management Server: > `mgmt_cli -d tp-api` > `mgmt_cli -d show-suggestions-summary layer ` > 4. Make sure the suggestions summary is reflected properly with the count per type (there are no errors). > 5. If errors are reflected, refer to **(Scenario 1) Policy Insights cannot be activated** : > 1. Make sure the required Jumbo Hotfix Accumulator package is installed > 2. Make sure the required Policy Insights Releases Updates package is installed and its version is up to date > > ### (Scenario 5) Policy Insights button shows 0 Insights in SmartConsole > > **Symptom:** > > Policy Insights button shows 0 Insights in SmartConsole for a while after onboarding. > > **Possible causes:** > > 1. You just turned on the "Policy Insights" card in SmartConsole. > 2. All of your suggestions are with low confidence. > 3. You already set feedback on all of your Insights. > 4. Log Servers are not reporting. > 5. Rules in the policy were created within the last 2 weeks. > 6. No logs are collected for Access Control rules with "Track" that is not set to "Log". > > **Solution:** > > 1. If you just onboarded, check your insights after 1-2 days. > 2. Check if the AI-Cloud Engine is still working on improving your insights: > Click the "Insights" button \> "Suggestions" view \> filter \> change the filter to include low-confidence suggestions > 3. Verify that the number of insights changed > (low-confidence suggestions are not displayed by default). > 1. You might have applied / declined your all insights. > Run on your Management Server: > * For Access Policy Insights: > * On a Security Management Server: > `mgmt_cli show access-layers` > * On a Multi-Domain Security Management Server: > `mgmt_cli -d show access-layers` > * For Threat Prevention Policy Insights: > * On a Security Management Server: > `mgmt_cli show threat-layers` > * On a Multi-Domain Security Management Server: > `mgmt_cli -d show threat-layers` > 2. Copy your access-layer ID. > 3. Run on your Management Server: > * For Access Policy Insights: > * On a Security Management Server: > `mgmt_cli afw-api` > `mgmt_cli show-suggestions-summary layer ` > * On a Multi-Domain Security Management Server: > `mgmt_cli -d afw-api` > `mgmt_cli -d show-suggestions-summary layer filters.states.1 ACCEPTED filters.states.2 REJECTED` > * For Threat Prevention Policy Insights: > * On a Security Management Server: > `mgmt_cli tp-api` > `mgmt_cli show-suggestions-summary layer filters.state REJECTED` > * On a Multi-Domain Security Management Server: > `mgmt_cli -d tp-api` > `mgmt_cli -d show-suggestions-summary layer filters.state REJECTED` > 4. Check that you received some insights in the output. > 5. Check when it will be next time that the AI-Cloud Engine will be generate new insights and check again > 4. Log Servers are not reporting. > See: > **(Scenario 3) Warning about Log Servers that do not report telemetry information** > 5. For troubleshooting causes 5 \& 6, see: > **(Scenario 6) Insights tab of a rule shows 0 suggestions in SmartConsole** > > ### (6) Insights tab of a rule shows 0 Insights in SmartConsole > > **Symptom:** > > No insights on a rule. > > **Possible causes:** > > 1. One of the below: > 1. You just turned on the "Policy Insights" card. > 2. All of your suggestions are with low confidence. > 3. You already set feedback on all of your Insights. > 4. Log servers are not reporting. > 2. Rules in the policy were created within the last 2 weeks. > 3. No logs are collected for Access Control rules with "Track" that is not set to "Log". > 4. For Threat Prevention Policy Insights - you may not have enabled any Threat Prevention Software Blades in Security Gateways. > > **Solution:** > > 1. See: > **(Scenario 5) Policy Insights button shows 0 suggestions in SmartConsole** > 2. Run on your Management Server: > * On a Security Management Server: > `mgmt_cli show-access-rule layer | grep -A 2 creation-time | grep 'iso-8601' | awk -F '"' '{print $2}'` > * On a Multi-Domain Security Management Server: > `mgmt_cli -d show-access-rule layer | grep -A 2 creation-time | grep 'iso-8601' | awk -F '"' '{print $2}'` > The system does not generate insights on a new rule until it has collected enough logs to achieve a proper insight. > 3. Verify that in the Access Control rule, in the "Track" column you selected "Log". > The system cannot generate insights without traffic logs for an access rule. > 4. For Threat Prevention Policy Insights - make sure you have Threat Prevention Software Blades enabled in the Security Gateways. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content