> Source: [sk183806](https://support.checkpoint.com/results/sk/sk183806)

# sk183806 - TP policy fails with error: load on module failed for threat prevention Error code 0-2-20000245 (Access Control)

| Property | Value |
|----------|-------|
| Solution ID | sk183806 |
| Date Created | 2025-08-20 |
| Last Modified | 2025-08-20 |
| Technical Level | General |
| Products | Security Management Server |
| Versions | R81.20 |
| OS | Gaia |
| Platform | Open Server |

## Symptoms

- * Policy installation fails on Virtual System Extension (VSX) cluster for both Threat Prevention (Anti-Bot and Anti-Virus) and Access Control modules.
* Error messages observed: load on module failed for threat prevention Error code 0-2-20000245 (Access Control)
* Attempts to install policies (Access Control and Intrusion Prevention System) repeatedly fail, even after restarting the Domain Management Server and updating IPS
* Temporary partial success: Removing dynamic_objects.db allowed Threat Prevention policy to install once, but Access Control policy still failed; subsequent attempts failed for both modules.
* No visible impact on network traffic, but inability to push or change policies resulted in high business impact.Customer unable to renew Remote Access Virtual Private Network (VPN) certificate due to policy installation failure, risking VPN user connectivity.

## Cause

Corruption or inconsistency in dynamic objects and temporary policy files on the Security Gateway caused the policy installation process to fail for both Threat Prevention and Access Control modules. Initial troubleshooting steps (removing dynamic_objects.db, updating online services, cleaning temporary directories) did not fully resolve the issue. The problem persisted due to deeper corruption in policy-related files or objects.

## Solution

1.**Remove and Backup Dynamic Objects Database:**   
On the Security Gateway, back up and remove the dynamic objects database:  
cp $FWDIR/database/dynamic_objects.db $FWDIR/database/dynamic_objects.db.bak  
rm -f $FWDIR/database/dynamic_objects.db  
2.**Clean Temporary Policy Directories:**   
Remove temporary files from the following directories:  
rm -rf $FWDIR/state/__tmp/\*  
rm -rf $FWDIR/tmp/install_policy/\*  
3.**Remove Online Services Files:**   
Delete all files under the online services directory:  
rm -rf $CPDIR/database/downloads/ONLINE_SERVICES/\*  
4. **Update Online Services:**   
Run the unified download command to update online services:  
unified_dl UPDATE ONLINE_SERVICES  
If the output shows "Last update status(11)", this indicates the update did not complete successfully. However, verify connectivity:  
curl_cli --cacert $CPDIR/conf/ca-bundle.crt https://updates.checkpoint.com/WebService/services/DownloadMetaDataService?wsdl  
5. **Remove Temporary Files in Policy Installation Directory:**   
Navigate to the policy installation directory and remove all files:  
cd $FWDIR/state/__tmp/fw1/1.0/  
rm -rf ./\*  
6.**Reinstall Policy and Regenerate Files:**   
Perform a full policy installation to regenerate all necessary files.  
7.**If required, run the following command to reload signatures:**   
fw load_sigs  
8.**Reboot Multi-Domain Server (if necessary):**   
The instruction includes a reboot request. Validate that there is no other option. Rebooting a firewall should be the last resort.  
Reboot the Multi-Domain Server and provide a backup for further analysis:  
mds_backup  
9.**Verify Policy Installation:**   
After completing the above steps, attempt to install the policy again. Confirm that the installation succeeds for both Threat Prevention and Access Control modules.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content