> Source: [sk183567](https://support.checkpoint.com/results/sk/sk183567)

# sk183567 - Security Group Member enters a boot loop after installing a Jumbo Hotfix Accumulator

| Property | Value |
|----------|-------|
| Solution ID | sk183567 |
| Date Created | 2025-07-15 |
| Last Modified | 2026-01-22 |
| Technical Level | Advanced |
| Products | Scalable Platforms |
| Versions | R82, R81.20, R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- * After installing a Jumbo Hotfix Accumulator on a Security Group Member (SGM), the SGM enters a reboot loop.

  These messages appear in the console output before each reboot:

  `[DATE | SYNC_IP] setting pol_time to XXX`  
  `
  [DATE | SYNC_IP] Applying fwaccel synatk configuration from file`  
  `
  Fetching Security Policy from local failed`  
  `
  [DATE | SYNC_IP] Trying to refetch policy`  
  `
  [DATE | SYNC_IP] Waiting for cluster to start (220)...`  
  `
  [DATE | SYNC_IP] Waiting for cluster to start (230)...`  
  `
  [DATE | SYNC_IP] Cluster is not started`
* The boot loop eventually stops after several reboots.

  The Security Group Member loads the "`defaultfilter`" policy.
* The file `$FWDIR/state/local/FW1/install_policy_report.txt` contains this error:

  `<HH:MM:SS> `2000244` InternalMsg InstallPolicyMgr ERROR install_policy_mgr.cpp 342 runInstallPolicy `Post load prepare failed
* Fetching the local policy under debug ("`fw -d fetch local`") shows errors about loading Updatable Objects:

  `[PID TID]@HOSTNAME[DATETIME] dnd_collector_report_updatable_obj: client 0 reported UO <Object Name> (<Object ID>)`  
  `
  [PID TID]@HOSTNAME[DATETIME] add_uo_item_to_uo_map: adding UO <Object Name> (<Object ID>) to map`  
  `
  [PID TID]@HOSTNAME[DATETIME] `add_uo_item_to_uo_map: key <XXX> doesn't exist in map  
  `
  [PID TID]@HOSTNAME[DATETIME] update_uo_clients_map: UO <Object ID> doesn't exist in map`  
  `
  `  
  `
  [PID TID]@HOSTNAME[DATETIME] fw_dtab_tabkbufs_realloc_one: realloc kbufs buffer from 372 to 5088`  
  `
  [PID TID]@HOSTNAME[DATETIME] dnd_loader_exec_cmd: executing command '/opt/CPsuite-R81.20/fw1/bin/dynamic_objects -dnd_load prepare access_fetch_local -no_lock' (blocking=1)`  
  `
  [PID TID]@HOSTNAME[DATETIME] `dnd_loader_exec_cmd: command finished with failure (exit code = 101)
* Executing the dynamic_objects under debug ("`TDERROR_ALL_ALL=5 $FWDIR/bin/dynamic_objects -dnd_load prepare access_fetch_local -no_lock`") shows the detailed error about loading Updatable Objects failed due to the missing package:

  `[PID TID]@HOSTNAME[DATETIME] parseDownloadsXml: exit`  
  `[PID TID]@HOSTNAME[DATETIME] FDT_GetLastRevisionFilesPath: Application (ONLINE_SERVICES), version (1.0)`  
  `[PID TID]@HOSTNAME[DATETIME] FDT_GetLastRevisionFilesPath: `(/opt/CPshrd-R81.20/database/downloads/ONLINE_SERVICES/1.0/last_revision.xml) doesn't exist  
  `[PID TID]@HOSTNAME[DATETIME] Unified_Download_Destroy_application_object: Activated with app_obj=0x91d2860`  

  `[PID TID]@HOSTNAME[DATETIME] dnd_loader_load_updatable_objects: package is missing (initiator=0)`  
  `[PID TID]@HOSTNAME[DATETIME] DYNAMIC_OBJECT> set_gui_msg: gui_msg_flag set to 1`  
  `[PID TID]@HOSTNAME[DATETIME] addCommitMsg: `Adding warning message: 'Updatable Objects are used in the policy but Gateway package is missing (see sk131852).'  
  `[PID TID]@HOSTNAME[DATETIME] dnd_loader_prepare: `dnd_loader_load_updatable_objects failed  
  `[PID TID]@HOSTNAME[DATETIME] dnd_loader_execute: dnd_loader_prepare failed`  
  `[PID TID]@HOSTNAME[DATETIME] command_dnd_load: dnd_loader_execute failed`  
  `[PID TID]@HOSTNAME[DATETIME] UPDATABLE_OBJECT> parse_flages: command_dnd_load failed`  
  `[PID TID]@HOSTNAME[DATETIME] DYNAMIC_OBJECT> ~dynamic_objects_guard_lock: release lock`

## Cause

The Access Control policy contains Updatable Objects, but the required package is missing from the directory `$CPDIR/database/downloads/ONLINE_SERVICES/1.0`.

If the Security Group Members do not have Internet access, they cannot download the Updatable Objects package automatically.

**Example output:**

`[Expert@HostName-ch0x-0x:0]# ls -lh $CPDIR/database/downloads/ONLINE_SERVICES/1.0`  
`
total 4.0K`  
`
-rw-rw---- 1 admin root 235 Jun 10 11:18 Update_Status.dat`

`[Expert@HostName-ch0x-0x:0]# cat $CPDIR/database/downloads/ONLINE_SERVICES/1.0/Update_Status.dat`  
`
(`  
` :Last_Update_Status (9)`  
` :Last_Update_Time (1749525622)`  
` :Last_Update_Reason ("Could not reach 'https://updates.checkpoint.com/WebService/services/DownloadMetaDataService?wsdl'. Check DNS and Proxy configuration on the gateway.")`  
`)`

As documented in [sk131852 - Updatable Objects](https://support.checkpoint.com/results/sk/sk131852):
> Starting from the Jumbo Hotfixes below, policy installation fails if the policy contains Updatable Objects but there is no package on the Security Gateway:  
>
> * R80.40 Jumbo Hotfix Take 211
> * R81 Jumbo Hotfix Take 99
> * R81.10 Jumbo Hotfix Take 131
> * R81.20 Jumbo Hotfix Take 43
> Because of this behavior, if you upgrade a Security Gateway that does not have a package to one of the Jumbo Hotfix Takes listed above, the Security Gateway does not fetch the policy after boot, and subsequent policy installations fail until a package is downloaded successfully.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content