> Source: [sk98768](https://support.checkpoint.com/results/sk/sk98768) # sk98768 - "Failed to create Mirror Domain Management Server" error when creating a Domain Management Server / Domain Log Server | Property | Value | |----------|-------| | Solution ID | sk98768 | | Date Created | 2014-03-03 | | Last Modified | 2023-05-11 | | Technical Level | General | | Products | Multi-Domain Security Management Server | | Versions | R82.10, R82.x, R81.20, R82, R82.20 | | OS | Linux, Gaia | ## Symptoms - "*Failed to create Mirror Domain Management Server*" error when creating a Domain Management Server / Domain Log Server ## Solution **Table of Contents:** * Introduction * Scenario 1 - IP address or name conflict with existing Domain Server * Scenario 2 - Required scheme file "mdsdb_new_scheme.C" was not updated * Scenario 3 - Lack of free space on the server * Scenario 4 - "$MDSDIR/conf/external.if" file is corrupted * Scenario 5 - Secondary Management object already exists in Primary database * Scenario 6 - Corruption in "$MDS_TEMPLATE/lib/libCCCIsSerialize.so" file * Scenario 7 - Missing registry creation template - $CPDIR/registry/HKLM_registry.data_cust * Scenario 8 - Corrupted registry creation template - $CPDIR/registry/HKLM_registry.data_cust
* Old versions
Show Entire Article Introduction {#Introduction} ---------------------------- This article describes different scenarios when creating a Domain Management Server / Domain Log Server fails with "***Failed to create Mirror Domain Management Server***" error. Each Scenario has additional details, mostly received from debugs, additional error messages, its own cause and solution. Scenario 1 - IP address or name conflict with existing Domain Management Server / Domain Log Server {#Scenario 1} ----------------------------------------------------------------------------------------------------------------- **Symptoms:** * "`Failed to create Mirror Domain Management Server`" error when creating a new Domain Management Server / Domain Log Server Show / Hide solution **Cause:** IP address or name of new Domain Management Server / Domain Log Server conflicts with the IP address or name of an existing Domain Management Server / Domain Log Server. **Solution:** 1. Verify all the IP addresses and name that are currently utilized on the Multi-Domain Server by running the mdsstat command in Expert mode. 2. Create the new Domain Management Server / Domain Log Server with an IP address and a name that does not conflict with any IP addresses and name that show up in the mdsstat command output **Note:** If "Failed to create Mirror Domain Management Server" error appears when creating a new Secondary Domain Management Server or a new Domain Log Server, verify also that name of the new Secondary Domain Management Server / Domain Log Server is not in conflict with the name of an existing object in the object database of an existing Domain Management Server of the same Domain. If the name of the new Secondary Domain Management Server / Domain Log Server is already used in the object database of an existing Domain Management Server of the same Domain, the object of the new Secondary Domain Management Server / Domain Log Server cannot be created in the object database of the existing Domain Mangement Server of the same Domain. So, modify the name of the already existing object or create the new Domain Management Server / Domain Log Server with a name that does not conflict with the name of the already existing object.
Scenario 2 - Required scheme file "mdsdb_new_scheme.C" was not updated {#Scenario 2} ------------------------------------------------------------------------------------ **Symptoms:** * "`Failed to create Mirror Domain Management Server`" error when creating a Domain Log Server. Show / Hide solution **Additional Symptoms:** * Issue occurs after upgrading the Multi-Domain Security Management Server and importing the Domain's database. * Debug of FWM daemon in MDS level (per [sk33208](http://supportcontent.checkpoint.com/solutions?id=sk33208)) shows: `Validation error in field 'cpver' at object '_._._cma_ng_vpn' @ 'network_objects' --> The value '9.0' is not in the list of valid values '{8.0,7.0,6.0,5.0,4.1,4.0}'` **Cause:** Required scheme file *$MDSDIR/conf/mdsdb/mdsdb_new_scheme.C* was not updated. **Solution:** Follow these steps: 1. Connect to command line on Multi-Domain Security Management Server and log in to Expert mode. 2. Switch to MDS level: **`[Expert@HostName]# mdsenv`** 3. Stop the MDS:***[Expert@HostName]# mdsstop -m*** 4. Delete the current *$MDSDIR/conf/mdsdb_new_scheme.C* file: **[Expert@HostName]# mv $MDSDIR/conf/mdsdb/mdsdb_new_scheme.C $MDSDIR/conf/mdsdb/mdsdb_new_scheme.C_BACKUP** 5. Clear SmartConsole cache (*CPMILinks\** ) as described in [sk100507 - SmartConsole problems with Security Management Server / Multi-Domain Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk100507) 6. Start the MDS: **[Expert@HostName]# mdsstart -m** 7. Wait for several minutes for SmartConsole cache to rebuild. 8. Create the Domain Log Server. Scenario 3 - Lack of free space on the server {#Scenario 3} ----------------------------------------------------------- **Symptoms:** * "`Failed to create Mirror Domain Management Server`" error when creating a Domain Log Server. Show / Hide solution **Additional Symptoms:** * Output of "*df -h* " command shows that */var/log* partition is used at 100%, or almost at 100%. **Cause:**Lack of free space on the server's hard disk. **Solution:** Remove unneeded files to free some space on the hard disk. Follow these articles: * [sk60316 - How to search for large files on SecurePlatform / Gaia OS](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk60316) Scenario 4 - "$MDSDIR/conf/external.if" file is corrupted {#Scenario 4} ----------------------------------------------------------------------- **Symptoms:** * "`Failed to create Mirror Domain Management Server`" error when creating a Secondary Domain Management Server. Show / Hide solution **Additional Symptoms:** * Debug of FWM daemon in MDS level (per [sk33208](http://supportcontent.checkpoint.com/solutions?id=sk33208)) shows on the Primary MDS: ``` MdsCPMIInterface::Command_CB> Entering method MdsCPMIInterface::Command_CB> reply set is: MdsCPMIInterface::Command_CB> command type 14 - New Mirror Domain Management Server MdsCPMIInterface::Command_CB> command uid 73 MdsCPMIInterface::Command_CB> command session XXX MdsCPMIInterface::Command_CB> cpresult XXX MdsCPMIInterface::Command_CB> last 1 MdsCPMIInterface::Command_CB> cpmiopid 53 MdsCPMIInterface::m_command_CB> Command failed uid=73 reason=Failed to assign virtual IP. ``` * Debug of FWM daemon in MDS level (per [sk33208](http://supportcontent.checkpoint.com/solutions?id=sk33208)) shows on the Secondary MDS: ``` if ( 1 ) /bin/echo -e Error assigning virtual ip X.X.X.X to Domain Management Server /bin/echo -e Error assigning virtual ip X.X.X.X to Domain Management Server Error assigning virtual ip X.X.X.X to Domain Management Server /opt/CPmds-/scripts/fwvirtualoff X.X.X.X Mgmt 1 -d /sbin/ifconfig Mgmt:1 down ``` **Cause:** During the creation of the Domain, the "netmask" should have been calculated by this line: `set netmask = '/sbin/ifconfig $inter | awk ' $1 == "inet" { split ($4,x,":"); print x[2] } ''` This command would fail if no IP address is assigned to the "Mgmt" interface. This could happen if *$MDSDIR/conf/external.if* file is corrupted, or if it was updated with invalid data. **Solution:** Edit the $*MDSDIR/conf/external.if* to contain the name of the correct Management interface. 1. Connect to command line and log in to Expert mode. 2. Backup the current file: **[Expert@HostName]# mv -v $MDSDIR/conf/external.if $MDSDIR/conf/external.if_BKP** 3. Edit the current file: **[Expert@HostName]# vi $MDSDIR/conf/external.if** 4. Add the name of the correct Management interface. 5. Save the changes and exit from Vi editor. 6. Restart Check Point services:***[Expert@HostName]# mdsstop ; mdsstart*** Scenario 5 - Secondary Management object already exists in Primary database {#Scenario 5} ----------------------------------------------------------------------------------------- **Symptoms:** * "`Failed to create Mirror Domain Management Server`" error when creating a Secondary Domain Management/Log Server. Show / Hide solution **Additional Symptoms:** * Debug of FWM daemon in MDS level (per [sk33208](http://supportcontent.checkpoint.com/solutions?id=sk33208)) shows: `cpmi_cmd_status_text ("Object `*DOMAIN_MANAGEMENT_NAME*` already exists")` **Cause:**An object for the Secondary Management Server already exists in the Primary Management server. **Solution:** In SmartConsole, delete the Secondary Management Server object. Scenario 6 - Corruption in "$MDS_TEMPLATE/lib/libCCCIsSerialize.so" file {#Scenario 6} -------------------------------------------------------------------------------------- **Symptoms:** * "`Failed to create Mirror Domain Management Server`" error when creating a Secondary Domain Management Server. Show / Hide solution **Additional Symptoms:** * Secondary DMS/CMA creation process fails at "`Failed to create a recovery profile for the Abra Password Reset operation.`" * When comparing the md5sum hash for '$MDS_TEMPLATE/lib/libCCCIsSerialize.so' on both the primary and secondary Multi Domain Management Servers, the results don't match. **Cause:** Corruption in the '*libCCCIsSerialize.so*' library file **Solution:** Replace the file on the Secondary Multi Domain Management Server with the correct file from the Primary Multi Domain Management Server, and test the procedure again. 1. Place the file (*libCCCIsSerialize.so* ) from the Primary Multi Domain Management Server into any folder on the Secondary Multi Domain Management Server (for instance /var/log/temp/) 2. Connect to command line and log in to Expert mode. 3. Backup the current file: **[Expert@HostName]# mv -v $MDS_TEMPLATE/lib/libCCCIsSerialize.so $MDS_TEMPLATE/lib/libCCCIsSerialize.so.orig** 4. Move the working file into the directory: ***\[*** **Expert@HostName]# mv /var/log/temp/libCCCIsSerialize.so $MDS_TEMPLATE/lib/libCCCIsSerialize.so** 5. Try to create the secondary DMS/CMA on the Secondary Multi Domain Management Server again: **[Expert@HostName]# mdsadd_customer "Domain_Name" -intf **` ` **Scenario 7 - Missing registry creation template - $CPDIR/registry/HKLM_registry.data_cust** ---------------------------------------------------------------------------------------------

Enabling the debugs with "fw debug mds on TDERROR_ALL_ALL=5 shows this in mds.elg: MSP_exec_cma_reg_command\> executing command: cpprod_util SetValue ... MSP_exec_cma_reg_command\> return value, 65128 ... CLocalCim::SetMirrorCmaOtp\> Failed to write otp to registry key ... Failed to create Mirror Domain Management Server **Solution:** Find an MDS machine with the $CPDIR/registry/HKLM_registry.data_cust file and move that file to the problematic MDS machine. Please never delete this file from MDS. Scenario 8 - Corrupted registry creation template - $CPDIR/registry/HKLM_registry.data_cust -------------------------------------------------------------------------------------------
**Symptoms:** * When creating a new secondary CMA, Create Domain Server Task completes with the following warning: "Create Domain server: 'secondary_cma_name' for Domain 'domain_name' completed on MDS secondary_mds_name Error: Check connectivity between Domain Server IPs and initialize SIC manually". * When running "mdsstat" on the secondary MDS, you see that the status of the FWM, FWD and CPD is up, however status of CPCA is down. * In $FWDIR/log/cpca.elg in the CMA you see error messages: "main: could not initialize the Certificate Authority. No Certificate Authority existing" * in $FWDIR/conf/ of the secondary CMA, files $FWDIR/conf/InternalCA.db and $FWDIR/conf/InternalCA.p12 are missing * When selecting the secondary CMA in SmartConsole, status of the CMA is: "Standby. No active server is present"
**Solution** : Possible corruption of the SIC and PRNG stanzas in $CPDIR/registry/HKLM_registry.data_cust on the MDS level. Please check that the SIC section of the customer template is ***completely empty*** , and consists ***only*** of `: (SIC) ` and PRNG section contains ***only*** Nonce: `: (PRNG` `:Nonce ("[3]00000000000000000000000000000006")` `)` If it does not, then backup HKLM_registry.data_cust, and remove all extraneous lines to make the sections look similar to: `[...]` ` )` ` )` ` )` ` : (SIC)` ` : (PRNG` ` :Nonce ("[3]00000000000000000000000000000006")` ` )` ` : (FG1` ` :CurrentVersion (6.0)` ` : (6.0` `[...] ` After that, delete the secondary CMA, and re-create it again. Running mdsstop/mdsstart is not necessary, as template is only used during CMA creation. Old versions {#Old versions} ---------------------------- Hotfix "gizmo_hf_base_229" / "gulli_hf_base_239" is installed {#Scenario 1} --------------------------------------------------------------------------- **Symptoms:** * "`Failed to create Mirror Domain Management Server`" error when creating a Secondary Domain Management Server / Domain Log Server. Show / Hide solution **Additional Symptoms:** * Output of "*mdsstat*" command shows that "fwm" and "cpca" processes do not run on the new created Secondary Domain Management Server / Domain Log Server. * Created object data is not found in *$FWDIR/conf/objects_5_0.C* file of Secondary Domain Management Server / Domain Log Server. **Issue:**01373006 **Cause:** Hotfix "*gizmo_hf_base_229* " / "*gulli_hf_base_239* " from [sk111293](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111293#Scenario 6) (Scenario 6) is installed that was created *before* 3rd March 2014. **Solution:** This problem was fixed. The fix is included in: * [Check Point R77.10](http://supportcontent.checkpoint.com/solutions?id=sk97617) Check Point recommends to always upgrade to the [most recent version](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=166). --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content