> Source: [sk97858](https://support.checkpoint.com/results/sk/sk97858)

# sk97858 - Troubleshooting "Reserved Words" issues in Security Management

| Property | Value |
|----------|-------|
| Solution ID | sk97858 |
| Date Created | 2013-12-24 |
| Last Modified | 2016-03-23 |
| Technical Level | General |
| Products | Security Management Server, Multi-Domain Security Management Server |
| Versions | R82.10, R82, R81.20, R82.10, R82.20, R81.20, R82, R82.20 |
| Platform | Smart-1 |

## Solution

**Table of Contents**

* Various Scenarios

  * Scenario 1: Global policy assign to CMA fails with "Token includes a reserved word" error message
  * Scenario 2: Policy Install fails with "/opt/CPmds-R60/customers/XXXX/CPR71CMP-R75/conf/XXXX.pf, line XXXX: ERROR: syntax error"
  * Scenario 3: Cannot create Multi-Domain Management Security Management Administrator that starts with sr\[0-9\]
  * Scenario 4: Kernel debug shows that traffic is dropped with "Reason: PSL Drop: INSPECT_STREAMING_0" or "Reason: spii inspection matrix drop"

Various Scenarios {#Various Scenarios}
======================================

There are a number of scenarios, in which you may encounter "Reserved Words" issues. The scenarios that we have encountered and dealt with are detailed below.

Refer to [sk40179 - What are the characters and reserved words forbidden for use in Check Point FireWall-1 ?](http://supportcontent.checkpoint.com/solutions?id=sk40179)

Scenario 1 {#Scenario 1}
------------------------

**Title: *Global policy assign to CMA fails with "Token includes a reserved word" error message***

**Product:** Multi-Domain Management / Provider-1

**Version:** R70, R70.1, R70.30, R70.40

**OS:** SecurePlatform 2.6

**Symptoms:**

* Global policy assign to CMA fails with following error message:"Illegal name for 'gsnmp-trap' @ 'services' - Token includes a reserved word"

**Cause:**The reserved token "TRAP" was added in R70.

**Solution:**

Contact [Check Point Support](http://www.checkpoint.com/services/contact/index.html) to get a Hotfix for this issue. A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix

*** ** * ** ***

Scenario 2 {#Scenario 2}
------------------------

**Title: *Policy Install fails with "/opt/CPmds-R60/customers/XXXX/CPR71CMP-R75/conf/XXXX.pf, line XXXX: ERROR: syntax error"***

**Product:** Multi-Domain Management / Provider-1, UTM-1, Security Gateway

**Version:** R75

**OS:**

**Symptoms:**

* Policy Install Fails with the following error:  
  "*/opt/CPmds-R75/customers/XXXX/CPR71CMP-R75/conf/XXXX.pf, line XXXX: ERROR: syntax error*   
  *Compilation failed.*   
  *Operation ended with errors.*"

**Cause:** The user is using a "Reserved Word" for an object (network, host, service, etc) inside of their rulebase. When they use this object and try to push policy they will get an error about "Syntax error". The *.pf* file inside of the error message lists the line with the syntax error. **This started with R75 with a lot of "NEW" reserved words.**

**Solution:**

In order to determine the "Reserved word" that is being used, you have to open the *.pf* file (listed in the error message) in a program like "ultraedit" (**non-notepad** ) and view the line number that is reporting the problem. This could be associated with a rule that will look like the following inside the mentioned *.pf*.

*accept eitherbound, start_rule_code(15),*   
*(tcp, microsoft-ds or nbsession or real-audio) or (udp, broadcast-38293) or (tcp, get \<dport\> from service_list16 to r_service_id, set r_mflags (r_mflags \| MFLAGS_OK)),*   
*(ip_src in ip_list17),*   
*(ip_dst in ip_list17), ALLOW_TEMPLATE_ACCELERATION,*   
*RECORD_CONN(15),*   
*LOG(long, LOG_NOALERT, 15);*

In the case above, the line with the issue is:

***(tcp, microsoft-ds or nbsession or real-audio) or (udp, broadcast-38293) or (tcp, get \<dport\> from service_list16 to r_service_id, set r_mflags (r_mflags \| MFLAGS_OK))*,**

Just above that you can see that the rule number associated with this is rule 15. This indicates that rule 15 is the rule for which there is a problem with the syntax.

In this case, the problem ended up being the service "**udp, broadcast-38293"**.

"**broadcast** " is a reserved word and cannot be used in R75. Once this service name was changed to not have "**broadcast**" in its name, then the policy was able to be installed with no issues.

**Note:** In each of these lines listing a "Syntax Error", the "syntax error" is different for each line. You will have to analyze each and every line and determine what is causing the syntax error.

--------------------------------

**Here is a list of "Reserved Words" that have been known to cause syntax errors:**

* **address**
* **broadcast**
* **data**
* **home**
* **local**
* **network**
* **pipe**
* **IPv6**

If any object has this anywhere in the object/name then it can cause syntax errors.   

**Example:** Host object named "Homer".. starts with "Home" and that will cause a syntax error.

Other words that are considered "Reserved Words":

* Days of the week
* Month Names
* Colors
* src
* dst

*** ** * ** ***

Scenario 3 {#Scenario 3}
------------------------

**Title: *Cannot create Multi-Domain Management Security Management Administrator that starts with sr\[0-9\]***

**Product:** Multi-Domain Management / Provider-1, Security Management

**Version:** All

**OS:**

**Symptoms:**

* "You cannot start a token with sr\[0-9\]" error on attempt to create a Management / Provider-1 / Security Management Administrator that starts with sr\[0-9\].

**Cause:** Words that start with "sr\[0-9\]" are reserved words in the code, and thus cannot be used within objects definition.

**Solution:**

Do not create any Check Point Object (i.e., Network Objects, Users, Groups, etc.) that starts with "sr\[0-9\]". EG: sr0..., sr1..., sr2..., sr215..., and so on are not permitted.

*** ** * ** ***

Scenario 4 {#Scenario 4}
------------------------

**Title: *Kernel debug shows that traffic is dropped with "Reason: PSL Drop: INSPECT_STREAMING_0" or "Reason: spii inspection matrix drop"***

**Product:** Security Gateway

**Version:** All

**OS:** All

**Symptoms:**

* Kernel debug ('`fw ctl debug -m fw + drop tcpstr spii`') shows:

  * *dropped by fwpslglue_chain Reason: PSL Drop: INSPECT_STREAMING_0*
  * *dropped by fw_spii_execute_inspections Reason: spii inspection matrix drop*

**Cause:** Reserved word is used in the name of the involved service.

**Solution:**

Check that none of the user-defined services contains reserved words as described in [sk40179 - What are the characters and reserved words forbidden for use in Check Point FireWall-1 ?](http://supportcontent.checkpoint.com/solutions?id=sk40179). Correct the names of the user-defined services and install policy.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content