FireWall-1 FAQ: Can't Replace Previously Installed Policy
Please note: This content was from when I was operating my FireWall-1 FAQ site, which I stopped operating in August 2005. For some reason people still have links to this stuff on the Internet that people are still clicking on.
I am making this information available again AS IS. Given how old this information is, it is likely wildly inaccurate. I have no plans to update this information.
If you're still running versions of Check Point VPN-1/FireWall-1 where this information is still relevant to you, do yourself a favor and upgrade to a more recent release. If you happen to be running a current release and the information is useful, it's by happenstance :)
Q:
--- (le0) control (le1) ---- (le0) gateway (le1) ---
Somehow, I had installed a policy on ‘gateway’ that block traffic from ‘control’. Now, from ‘control’ I cannot communicate with ‘gateway’ to install a new policy that will allow traffic from ‘control’ to ‘gateway’. How can I get out of this deadlock?
or:
After (reinstalling) a - busy - firewall1 (between 8-10Mbps over the external interface), a problem which we were trying to get rid of reappeared – customer insists on “Account” logging for traffic to its DMZ - (motivation is commercial/financial)
Problem is that, when “Account” logging is activated, the firewall panics when reloading the policy. My principal problem now is that after reboot, the firewall automatically loads the policy with the “account” logging activated. Our guess is that, since the latest policy - without account logging - did not successfully load, the firewall somehow finds and loads the previous version. Weird thing is that the GUI and the real loaded policy no longer match !
A:
FireWall-1 stores the last installed policy in $FWDIR/state. If you haven’t been able to install the policy since this problem started occurring, then you’ve got the old policy there. You can clear $FWDIR/state on both your management console and firewall module. This should prevent FireWall-1 from loading a policy on startup. Then you can load the proper policy from your management console.
