ExamFinch.com My Study

Study guide

7.8 cpinfo and Common Issues

Practice this exam

CCSA R82 — Check Point Certified Security Administrator Study Guide Exam

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Introduction & Architecture

1.1 CCSA R82 Exam Facts 1.2 Standalone vs Distributed Deployment 1.3 Gaia OS, clish and expert Mode 1.4 The SmartConsole Suite 1.5 Secure Internal Communication and the ICA

2 Chapter 2: Security Policy & Access Control

2.1 Policy Packages 2.2 Access Control Policy Overview 2.3 Ordered Layers and First-Match Evaluation 2.4 Inline Layers and Nested Rule Matching 2.5 Access Rules: Fields, Actions, and Track Options 2.6 Implied Rules and Global Properties 2.7 Stealth and Cleanup Rules: Placement and Best Practice 2.8 Hit Count and Policy Install Workflow

3 Chapter 3: Network Address Translation (NAT)

3.1 NAT Overview in Check Point 3.2 Hide NAT (Many-to-One) 3.3 Static NAT (One-to-One) 3.4 Automatic vs Manual NAT and Proxy ARP

4 Chapter 4: Identity Awareness

4.1 Identity Awareness Overview 4.2 Active Directory Query 4.3 Identity Collector 4.4 Identity Agent 4.5 Captive Portal and Access Roles

5 Chapter 5: Threat Prevention

5.1 Threat Prevention Overview 5.2 Application Control 5.3 URL Filtering 5.4 Intrusion Prevention System (IPS) 5.5 Anti-Bot and Anti-Virus 5.6 Threat Emulation and Threat Extraction 5.7 TP Profiles, Best Practice, and Ordered Layers for TP 5.8 HTTPS Inspection

6 Chapter 6: ClusterXL — High Availability, Load Sharing, and Failover

6.1 ClusterXL Overview: Why Clustering, HA vs Load Sharing 6.2 High Availability Mode: Active/Standby, Primary Up vs Active Up 6.3 Load Sharing Modes: Multicast, Unicast (Pivot), and Traffic Distribution 6.4 Cluster Control Protocol (CCP) and State Synchronization 6.5 Failover, Cluster States, and Troubleshooting with cphaprob

7 Chapter 7: VPN, Logs, and Troubleshooting

7.1 Site-to-Site IPsec VPN 7.2 Remote Access VPN 7.3 Encryption Domains and VPN Communities 7.4 Mobile Access Blade 7.5 Logs, Monitor, and SmartEvent 7.6 Backups, Snapshots, and Migrate Export 7.7 fw monitor, fw ctl zdebug, and cpview 7.8 cpinfo and Common Issues

7.8 cpinfo and Common Issues

Key Takeaways Explain This Topic AI

cpinfo collects system info, configuration, and sanitized logs into one file for TAC analysis with DiagnosticsView (sk125092).

SIC errors are logged in $CPDIR/log/sic_info.elg on both sides; status values are Communicating, Unknown, and Not Communicating.

Policy install failures split into compilation (cpm.elg, fwm.elg) versus distribution (fwd.elg, cpd.elg, sic_info.elg).

Always check cpwd_admin list, fw stat, df -h, and free -m before resetting SIC — a full disk or dead process mimics many Check Point errors.

Last updated: July 2026

cpinfo and Common Troubleshooting Scenarios

cpinfo is the single command Check Point Support asks for first. It collects system information, configuration, and a sanitized set of logs from a gateway or Management Server into one compressed file that TAC can analyze with DiagnosticsView (sk125092). On R82 the relevant SK is sk92739 for collecting cpinfo and sk125092 for analyzing it. Knowing when to collect cpinfo, what it contains, what it does not contain, and how it fits in the broader troubleshooting workflow is a CCSA staple.

  • cpinfo Basics cpinfo # full cpinfo from a gateway
  • cpinfo -l # limited output (build/version info only)
  • cpinfo -h # hardware info (replaces asg_collect_vsx_logs on Scalable Platforms)

When opening a support case you collect a full cpinfo plus (per the R82 pre-upgrade checklist) a snapshot, a system backup, and the migrate export. cpinfo is not encrypted ; it contains configuration and log snippets, so handle it as confidential and transfer it via secure channels. cpinfo is a snapshot of state at collection time — it does not include live debugging output, so for intermittent issues you may need to run fw ctl zdebug or fw monitor while the problem is occurring and attach those outputs separately.

SIC Failures

Secure Internal Communication (SIC) is the certificate-based mutual auth between the Management Server and gateways. Without it you cannot install policy or send logs. SIC errors are logged in $CPDIR/log/sic_info.elg on both sides.

SIC status values:

Status Meaning

Communicating Trust established; management can talk to the gateway over SSL with ICA-issued certificates.

Unknown Management cannot contact the gateway at all.

Not Communicating Management can reach the gateway but cannot establish SIC. A detailed message is shown.

Troubleshooting sequence (official R82 order):

Verify IP connectivity between Gateway and Management Server.

Confirm the same one-time activation key was used on both sides.

If Management is behind a gateway, ensure rules and Anti-Spoofing allow the connection.

Ensure the Management Server's name and IP are in the gateway's /etc/hosts .

If Management is behind static NAT, add the public IP to the remote gateway's /etc/hosts (must resolve to hostname).

Verify date and time — clock skew can make certificates not-yet-valid.

Re-establish trust.

To reset trust: run cpconfig on the gateway → Secure Internal Communication → enter a new activation key; then in SmartConsole enter the same one-time password and click Initialize . Useful CLI on the gateway: cp_conf sic state (current state), cp_conf sic init (reset key), cp_conf sic cert_pull <MGMT_IP> <GW_NAME> (for DAIP gateways).

Policy Install Errors

A policy install failure breaks down into two phases:

Compilation failure — fails before reaching the gateway; investigate CPM, FWM, the policy package, the objects database, validation, and management performance. Logs: $FWDIR/log/cpm.elg , $FWDIR/log/fwm.elg .

Distribution failure — fails while pushing to the gateway; investigate CPD, SIC, CPCA/ICA, FWD, network reachability, gateway disk space, gateway processes, and policy load. Logs: $FWDIR/log/fwd.elg , $CPDIR/log/cpd.elg , $CPDIR/log/sic_info.elg .

Process health first: cpwd_admin list shows whether key Check Point processes are alive and monitored. On a gateway, fw stat / fw stat -l shows the policy currently loaded. df -h and free -m — a full disk or exhausted memory breaks many "Check Point" symptoms that look like SIC or policy issues. A disk-full /var is one of the most common causes of policy install failure because the gateway cannot write the new policy files.

To unload policy for emergency access without installing a new one, fw unloadlocal on the gateway disables the current policy (no filtering). Use only for break-glass troubleshooting because the gateway becomes a router.

A real-world example: SIC error 325 ("SIC General Failure") on R82.10 cross-AZ cluster installs. SIC trust initialized fine, but Install Policy always failed. Root cause was a certificate date-validation bug (sk184766); resolution was to apply JHF Take 464 or higher. The lesson: when SIC is up but every install fails with a SIC error, suspect certificate/time-related bugs and check the JHF level before resetting trust.

Common Issues — Quick Triage

  • Symptom First check
  • SIC won't initialize Connectivity, activation key match, /etc/hosts , time sync

Install policy: SIC General Failure Is it compilation or distribution? fwm.elg / cpd.elg / sic_info.elg ; check JHF

  • Trust state "Not Communicating" Certificates, CPD, network filtering, hostname/IP resolution
  • Logs missing in SmartView Log indexing state; Log Server reachability; SIC to Log Server
  • Disk full df -h — breaks many symptoms that look like Check Point issues
  • Process not running cpwd_admin list — every key process should show status "E" (established)
  • VPN tunnel won't build Pre-shared secret match; VPN domain overlap; IKE version match; NAT-T
  • The CCSA Mindset

Don't react to the error string. Identify which process in the chain failed: SmartConsole → CPM → PostgreSQL/objects DB → FWM/FWD → CPD → CPCA/ICA → gateway → FWK/FW. The fix follows from where the chain broke, not from the wording of the error. Collect cpinfo as evidence early, check process health and system resources next, and only then start resetting trust or restarting services.