> Source: [sk184170](https://support.checkpoint.com/results/sk/sk184170)

# sk184170 - Unable to Open or Download Forensics Reports from Harmony Endpoint Management Server

| Property | Value |
|----------|-------|
| Solution ID | sk184170 |
| Date Created | 2025-11-10 |
| Last Modified | 2025-11-17 |
| Technical Level | Advanced |
| Products | Endpoint Security |
| Versions | R81.20 |
| OS | Gaia |
| Platform | Smart-1, VMWare ESX, Open Server, Hyper-V |

## Symptoms

- * Users cannot open or download forensics reports from the Harmony Endpoint Management Server.
* Error message displayed: `Failed to open attachment. Make sure you have permission and that the attachment was not already deleted.`
* The issue occurs regardless of the report status (detect or prevent).
* Forensics reports are generated and present on the Harmony Endpoint client but cannot be accessed from the management server.
* Incident IDs and logs are present on both the client and server, but the server fails to fetch the report blob.
* Log analysis shows errors related to network object mapping and failed blob fetches for IP address x.x.x.x.
* FwD Debugs collected and Error in fWd.elg.X shows:

  ```
  [FWD 9988 3929850304]@[DATE TIME] kiss_stat_server_connection_handler: Sending 3 categories data, connection 
  [FWD 9988 3929850304]@[DATE TIME] kiss_stat_server_connection_handler:connection , state 
  [FWD 9988 3929850304]@[DATE TIME] kiss_stat_server_connection_handler:Finished sending 3 categories data
  [FWD 9988 3763182400]@[DATE TIME][FWLOG_GET_BLOB_TOPIC] CBlobToCacheOpaque::Deserialize: Got from the blobs DB these values :
   a_pRowValues[eIncidentUID] '', a_pRowValues[eOriginIP] '', a_pRowValues[eTransport] '', a_pRowValues[eRetryCount] '', a_pRowValues[eLogTime] '', a_pRowValues[eProduct] '', a_pRowValues[eProductFamily] '', a_pRowValues[eSicName] =
  [FWD 9988 3763182400]@[DATE TIME][FWLOG_GET_BLOB_TOPIC] CBlobToCacheOpaque::Deserialize: m_opIncidentGuid '', m_nOriginIP '', m_sTransport '', m_nRetryCount '', m_nLogTime '', m_sProductName '', m_sProductFamilyName '', m_sSICName ''
  [FWD 9988 3763182400]@[DATE TIME][FWLOG_GET_BLOB_TOPIC] CBlobCacheMgr::FetchBlobCB: fetching blob from gateway (SIC , IP , transport , incident uid , product , product family , retry no. )
  [FWD 9988 3763182400]@[DATE TIME][FWLOG_GET_BLOB_TOPIC] CBlobCacheMgr::FetchBlob: No Error committing transaction Select * from BLOB_CACHE where status="waiting" AND last_retry_time <  order by last_retry_time ASC Limit 200
  [FWD 9988 3763182400]@[DATE TIME] CCpobjCache:GetIPToSicName Error: Could not find net obj for ip -  [FWD 9988 3763182400]@[DATE TIME] CBlobFetcherThread::StartBlobFetch: failed to get<
  ```

## Cause

The server was configured with two network ports (eth0 and eth1). The forensics report fetch process attempted to use the eth1 port (different IP Subnet Address), which was not correctly mapped as a network object in Smart Console. This misconfiguration prevented the server from mapping the IP address to a Secure Internal Communication (SIC) name, resulting in failed blob fetches and inability to open or download forensics reports. Only one network port should be configured for the management server to avoid such conflicts.  

This issue is caused by a misconfiguration on the Harmony Endpoint Management Server. The server was configured with two network ports (**eth0** and **eth1** ). The forensics report fetch process attempted to use **eth1** , which belongs to a different IP subnet and was not correctly mapped as a network object in Smart Console. This prevented the server from resolving the IP address to a Secure Internal Communication (SIC) name, resulting in failed blob fetches.  

To avoid such conflicts, it is recommended to configure only one network port on the management server.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content