> Source: [sk183361](https://support.checkpoint.com/results/sk/sk183361)

# sk183361 - Processes Restart or Terminate on a Security Gateway

| Property | Value |
|----------|-------|
| Solution ID | sk183361 |
| Date Created | 2025-04-14 |
| Last Modified | 2025-04-20 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20 |
| OS | Gaia |

## Symptoms

- * Some processes are restarted or terminated on a Security Gateway, randomly, or after an IP change. Affected processes include:  
  FWD, RAD, DASERVICE, AUTOUPDATER, CPD.
* The Security Gateway is configured as a dynamically assigned IP address. The gateway IP is received by one of the following:

  ```
  
  - Dynamic Host Configuration Protocol (DHCP)
  - Point-to-Point Protocol over Ethernet (PPPoE)
  - Maas Tunnel
  ```

  <br />

  You can verify this configuration by the following methods:  

  ```
  
  (a) 
  Run the following command and verify the output:
  
   cpprod_util FwIsDAG  
  
  Check if the output is 1.
  
  (b)
  Check the registry file located at:$CPDIR/registry/HKLM_registry.data 
  
  Look for the entry:
  :DAG ("[4]1")
  
  (c)
  Review the gateway object file in SmartConsole:
  
  $FWDIR/database/myself_objects.C: 
  
  Look for:
  :DAG (true)
  ```

* The Security Gateway logs indicate that cpstop is called at the time of the issue: $CPDIR/log/cpstop.log   
  Using 'ps auxfww' you can see 'cprestart' was triggered by FWD:

  ```
  
  admin     5627  0.2  1.2 768968 193980 ?       Ssl  Feb20  19:11  _ fwd
  admin     6512  0.0  0.3 374368 54836 ?        Sl   Feb20   0:03  |   _ in.asessiond 0
  admin     6515  0.0  0.2 201496 32424 ?        S    Feb20   0:02  |   _ usrchkd 0
  admin     6519  0.0  0.2 135424 36288 ?        S    Feb20   0:26  |   _ tpd 0
  admin     6522  0.0  0.1  53804 24844 ?        S    Feb20   0:53  |   _ wstlsd 0 0
  admin     6523  0.0  0.1  53860 24584 ?        S    Feb20   0:53  |   _ wstlsd 0 1
  admin     6527  0.0  0.1  53812 24640 ?        S    Feb20   0:53  |   _ wstlsd 0 2
  admin     6528  0.0  0.1  53804 24608 ?        S    Feb20   0:51  |   _ wstlsd 0 3
  admin     6529  0.0  0.1  53808 24584 ?        S    Feb20   0:52  |   _ wstlsd 0 4
  admin     6530  0.0  0.1  53804 24884 ?        S    Feb20   0:53  |   _ wstlsd 0 5
  admin     7267  0.1  0.3 265932 48908 ?        Sl   Feb20   7:10  |   _ iked 1
  admin     7268  0.1  0.3 286892 50744 ?        Sl   Feb20   7:26  |   _ iked 2
  admin     7383  0.1  0.3 307236 50400 ?        SLl  Feb20   9:13  |   _ vpnd 0
  admin     7384  0.1  0.2 266004 47336 ?        Sl   Feb20   7:12  |   _ iked 0
  admin     9115  0.0  0.0   3644  1324 ?        S    10:11   0:00  |   _ /bin/bash /opt/CPshrd-R81.20/bin/cprestart
  admin     9121  0.0  0.0   3380  1048 ?        R    10:11   0:00  |       _ ps auxfww
  admin     6410  0.0  0.3 228156 56156 ?        Ss   Feb20   0:05  _ dlpu -i4 0 1 -i6 -1 -1
  admin     6424  0.0  0.2 228092 46280 ?        Ss   Feb20   0:05  _ dlpu -i4 2 3 -i6 -1 -1
  admin     6439  0.0  0.3 228108 52296 ?        Ss   Feb20   0:05  _ dlpu -i4 4 5 -i6 -1 -1
  admin    25316  0.0  0.0  35132  5756 ?        Ss   Feb20   4:56  _ spike_detective
  admin     8322  0.0  0.0  71836  8696 ?        Sl   Feb17   1:06 /opt/CPda/bin/DAService
  ```

* cpwd.elg shows FWD is restarted:

  ```
  
  # cat  /opt/CPshrd-R81.20/log/cpwd.elg | grep -i fwd
  [SUCCESS] Process FWD (pid=24405) stopped with command "fw kill -15 fwd". Exit code 0.
  [SUCCESS] FWD path /opt/CPsuite-R81.20/fw1/bin/fw, command fwd started successfully (pid=11729)
  ```

  <br />

  $FWDIR/log/fwd.elg:

  ```
  
  Signal 15 received: Number: 15; errno: 0; Code 0; Sending PID: 6087; Real sending UID: uid 0; Status: 169299812; Band: 6087; fd: 0;
   FireWall-1 daemon going to die on sig  15
  ```

## Cause

When a Security Gateway is configured with a Dynamic Assigned IP address (DAIP), any change in IP addresses will trigger the `cprestart` process. This can occur for:  

* Manual IP address changes
* Changes by the Internet Service Provider (ISP) via DHCP or PPPoE
* Temporary down/up state of the MaaS tunnel (even if the IP address does not change).  
  In this case, the `cprestart` is initiated, leading to service interruption.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content