> Source: [sk184660](https://support.checkpoint.com/results/sk/sk184660) # sk184660 - Policy installation fails on a Security Group managed by Smart-1 Cloud during upgrade | Property | Value | |----------|-------| | Solution ID | sk184660 | | Date Created | 2026-02-10 | | Last Modified | 2026-08-24 | | Technical Level | General | | Products | Scalable Platforms | | Versions | R82.10, R82 | | OS | Gaia | ## Symptoms - During the upgrade of a Maestro / ElasticXL Security Group, as described in the *Scalable Platforms Administration Guide*, one step is to change the version of the Security Gateway object in SmartConsole and install the policy. If you manage Security Group with Smart-1 Cloud, policy installation may fail with this error: `Installation failed. Reason: TCP connection failure (port=18191)(IP= IP_address_of_Security_Group) [error no. 10]` `Installation failed. Reason: SIC General Failure [ SIC error no. 148 ]` ## Cause When a Security Group managed by Smart-1 Cloud (Management as a Service) is in a mixed-version state during an upgrade, policy installation traffic from the Management Server reaches the Security Group through the `maas_tunnel` interface of the SMO, and the cluster correction mechanism redirects it to the upgraded Security Group Member (which runs the new version). Because the `maas_tunnel` interface has no MAC address, the correction cannot be performed on the `maas_tunnel` interface itself - it must be performed via the Sync interface. This is enabled with the ccl_on_sync_only parameter (see Step 3 in the "Solution" section). In addition, two separate issues can break this redirection: 1. Fragmented corrected packets are lost. When the corrected packets are fragmented, they are lost on the way to the upgraded Security Group Member, the Management Server's TCP connection to port 18191 does not establish, and the installation fails with "`error no. 10`". The fix for this issue is included in: * R82 Jumbo Hotfix Accumulator, Take 103 and higher * R81.20 Jumbo Hotfix Accumulator, Take 158 and higher 2. In the R82.10 version, reply packets that the upgraded Security Group Member sends through its own `maas_tunnel` interface bypass the Firewall inspection. The Firewall never sees the Security Group Member's \[SYN-ACK\], the connection never reaches the "Established" state, and the Management Server's subsequent packets are dropped as out-of-state (`fw_tcp_state_update: Illegal post SYN packet`). The installation fails with "`SIC error no. 148`". The fix for this issue is included in: * R82.10 Jumbo Hotfix Accumulator, Take 36 and higher Applies only when the upgraded Security Group Member that runs the R82.10 version. ## Solution Several options are available. ### Preferred - install the fixes and use the standard installation flow 1. Before starting the upgrade, on the current Security Group version install the Jumbo Hotfix Accumulator that includes the fix for the lost fragmented corrected packets: * R82 Jumbo Hotfix Accumulator, Take 103 and higher * R81.20 Jumbo Hotfix Accumulator, Take 158 and higher Note - If it is not possible to install the required Jumbo Hotifx Accumulator on the Security Group, then follow "**Workaround Part 1**" below. 2. Follow this upgrade plan: 1. Upgrade Security Group Members in the logical group "A". 2. Install R82.10 Jumbo Hotfix Accumulator, Take 36 (or higher) on Security Group Members in the logical group "A". 3. Security Group, open the Security Gateway object for this Security Group and change the "Version" to the target version. 4. Security Group, install policy on the Security Group. 5. Enable the Correction-via-Sync mode on **all** Security Group Members. Run on the Security Group in the Expert mode: `g_fw -a ctl set int ccl_on_sync_only 1 -a` Note - This setting does not survive a reboot. 6. Perform a failover to the upgraded Security Group Members in the logical group "A". 7. Upgrade Security Group Members in the logical group "B". 8. Install R82.10 Jumbo Hotfix Accumulator, Take 36 (or higher) on Security Group Members in the logical group "B". 9. In SmartConsole, install policy on the Security Group. 10. Enable the Correction-via-Sync mode on **all** Security Group Members. Run on the Security Group in the Expert mode: `g_fw -a ctl set int ccl_on_sync_only 1 -a` Note - This setting does not survive a reboot. 11. After the upgrade completes, disable the Correction-via-Sync mode on **all** Security Group Members. Run on the Security Group in the Expert mode: `g_fw -a ctl set int ccl_on_sync_only 0 -a` 3. This step is relevant only in the following scenario: 1. Smart-1 Cloud runs the R82.10 version 2. The policy installation fails with this error: `Policy installation failed on gateway because the gateway version, as defined in SmartConsole, does not match the version installed on the gateway.` Configure the hardware type of the Security Gateway object with the Management API. **Important** - Changing the hardware type in SmartConsole in the Security Gateway object does not solve the problem. 1. Run the applicable Management API command: * For an ElasticXL Security Group, run this Management API command: `set simple-gateway name hardware "ElasticXL Appliances"` * For a Maestro Security Group, run this Management API command: `set simple-gateway name hardware "Maestro Appliances"` 2. Publish the session: `mgmt_cli publish` **Important** - Do NOT install the policy yet on this Security Gateway object. 4. In the Security Gateway object, change the "**Version**" to the upgraded version and install the Access Control Policy as described in the Scalable Platforms Administration Guide. ### Workaround Part 1 - Manually compile and fetch the Access Control Policy Follow this procedure, if it is not possible to install the required Jumbo Hotifx Accumulators on the Security Group. **Prerequisite** - This procedure works only if the upgraded Security Group Members have their own active MaaS tunnel. 1. On the Security Group, run: `maas status` Confirm that the upgraded Security Group Member shows "`MaaS Tunnel State: Up`" and has its own "`Gateway IP for MaaS Communication`". If the tunnel on the upgraded Security Group Members is down, re-establish it first with the command "`maas on`". If it cannot be established, follow "**Workaround Part 2**" below. 2. Compile the Access Control Policy (Prepare Only): 1. Connect with SmartConsole to Smart-1 Cloud (in the Smart-1 Cloud portal, click Open in Installed SmartConsole, or select Stream SmartConsole in a browser). 2. From SmartConsole, open the Command Line (mgmt_cli) and run: `install-policy policy-package --sync false targets prepare-only true` Note - This command compiles the Access Control Policy using the upgraded version, but does not push it to the Security Group Members. 3. Fetch the Access Control Policy on the upgraded Security Group Members: 1. Connect to the command line on the Security Group. 2. Go to the context of the upgraded Security Group Member: `member _` 3. Fetch the Access Control Policy: `fw fetch -n -a -s -f -c` 4. If Threat Prevention Software Blades are enabled, fetch the Threat Prevention policy: `fw amw fetch -f` 5. Verify that the policy is installed successfully: `cpstat -f policy fw` 6. If successful, stop here. ### Workaround Part 2 - Fallback (if Workaround Part 1 fails) > If any of the steps above fail, contact [Check Point Support](https://www.checkpoint.com/support-services/contact-support/). > > A Support Engineer will: > > 1. Provide the required policy files. > > 2. Assist with transferring and installing the policy package. > > 3. Assist with completing the upgrade process. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content