> Source: [sk183846](https://support.checkpoint.com/results/sk/sk183846)

# sk183846 - "Topology Undefined" warning in SmartConsole during Threat Prevention policy installation

| Property | Value |
|----------|-------|
| Solution ID | sk183846 |
| Date Created | 2025-08-25 |
| Last Modified | 2025-09-10 |
| Technical Level | General |
| Products | Security Gateway, Security Management Server, SmartConsole |
| Versions | R82, R81.20, R82, R81.20, R82, R81.20 |

## Symptoms

- * When installing a Threat Prevention policy on Quantum Spark or VSX cluster gateways, this warning appears for the cluster object:  
  "*Threat Prevention requires topology to be defined. At least one internal, one external, and no undefined interfaces are required. Incorrectly defined topology impacts performance and security* ".  
  This warning appears even though the cluster object has at least one internal interface, one external interface, and no undefined interfaces.

* Policy installation completes successfully.

* Changing the topology definition in the cluster object from manual to automatic, temporarily resolves the warning, but it reappears when the topology is set back to manual.

## Solution

Do these steps on the Security Management Server:  

1. **Preparation**
   1. Take Gaia snapshots and backups of the Security Management Server.
   2. Install the latest build of CPUSE Agent as per the section "(3) Latest build of CPUSE and What's New" of [sk92449](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#Latest%20build%20of%20CPUSE%20and%20What's%20New).  

2. **Hotfix Installation**   
   Install a temporary private instrument fix "added debugs - PRHF-41318"   
   [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
   A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
   For faster resolution and verification please collect [CPinfo](https://support.checkpoint.com/results/sk/sk92739) files from the Security Management and Security Gateways involved in the case.  

3. **Debugging steps**
   1. Connect to Security Management Server through SSH.
   2. Enable these environment variables:
      1. `[Expert@<MGMT-NAME>:0]# export INTERNAL_POLICY_LOADING=1`
      2. `[Expert@<MGMT-NAME>:0]# $MDS_FWDIR/scripts/reload_env_vars.sh -e "CHECKPOINT_INSTALL_POLICY_DISABLE_MULTIPLE_ROOTS=1"`
   3. Install **only**Threat Prevention policy from SmartConsole.
   4. Run this command on the Security Management Server to list all processes related to policy loading, and collect the output.   
      Run:  
      `[Expert@<MGMT-NAME>:0]# ps -ef | grep load`  
      Example output:  
      `admin 40393 20178 73 07:03 ? 00:00:00 `**/opt/CPsuite-R81.20/fw1/bin/fwm load -M -r -X /opt/CPsuite-R81.20/fw1/tmp/fwm_load.state.ANTIMALWARE_PRODUCT -U admin -N <Relevant IP> -I <Relevant IP> -C SmartConsole -p threatprevention <Policy Name> <Cluster Name>**
   5. Collect debug output from the Security Management Server.   
      Run:  
      `[Expert@<MGMT-NAME>:0]# TDERROR_ALL_ALL=5 <Command from above> &> fwm.txt`  
      Example output:  
      `[Expert@<MGMT-NAME>:0]# TDERROR_ALL_ALL=5 R81.20/fw1/bin/fwm load -M -r -X /opt/CPsuite-R81.20/fw1/tmp/fwm_load.state.ANTIMALWARE_PRODUCT -U admin -N <Relevant IP> -I <Relevant IP> -C SmartConsole -p threatprevention <Policy Name> <Cluster Name> &> fwm.txt`
   6. Review the topology in the `fwm.txt` file. Run:  
      `[Expert@<MGMT-NAME>:0]# grep VerifyTopology fwm.txt`  
      Example output:  
      `[Expert@<MGMT-NAME>:0]# grep VerifyTopology fwm.txt`  
      `[FWM 40554 4004753856]@<MGMT-NAME>[<Date> <Timestamp>] VerifyTopology warning: Interface `**<Relevant LAN Interface>**` of object `**<Cluster Name>**` is Undefined.`  

4. **Topology Review and Correction**
   1. In SmartConsole, go to the **Gateways \& Servers** view \> select the cluster object \> right-click it and select **Edit**.
   2. In the cluster object properties window, go to **Topology \> Edit Topology**
   3. Review the topology column and confirm that there are at least one internal interface, one external interface, and no undefined interfaces
   4. Confirm the configuration of both cluster members:
      1. Remove the cluster interface.
      2. Edit each member interface and define the topology:  

         ![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1756028913865/Edit202508241236053.png)
      3. Add the cluster interface back.
      4. Assign the correct topology to the cluster interface.   

5. **Cleanup**   
   On the Security Management Servers, disable these environment variables.   
   Run:  
   `[Expert@<MGMT-NAME>:0]# unset INTERNAL_POLICY_LOADING`  
   `[Expert@<MGMT-NAME>:0]# $MDS_FWDIR/scripts/reload_env_vars.sh -u "CHECKPOINT_INSTALL_POLICY_DISABLE_MULTIPLE_ROOTS"`  

6. Publish the session in SmartConsole.  

7. Install policy and make sure that the issue is resolved.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content