After policy installation, Security Gateway drops all traffic with "up_manager_fw_handle_first_packet: cmi_context_exec_with_chain_connkey() failed;"

Product: ClusterXL, Maestro HyperScale Firewall, Scalable Chassis, Security Gateways, VSX (Traditional)
Version: R80.40 (EOS), R81 (EOS), R81.10 (EOS), R81.20
OS: Gaia
Last Modified: 2025-12-21

Symptoms

• After policy installation, the Security Gateway / one or more ClusterXL Member / one or more Security Group Members drop all traffic.

• running fw ctl zdebug + drop shows these messages for the dropped traffic:

  ;[SOURCE_IP:SOURCE_PORT -> DEST_IP:DEST_PORT] [ERROR]: up_fw_exe_inspect_services_match: vm_exec failed;
  ;[SOURCE_IP:SOURCE_PORT -> DEST_IP:DEST_PORT] [ERROR]: up_services_classifier_match_inspect_services: 'up_inspect_services_match' failed (via hook);
  ;[SOURCE_IP:SOURCE_PORT -> DEST_IP:DEST_PORT] [ERROR]: up_services_classifier_cmi_handler_match_cb: up_services_classifier_match_inspect_services() failed.;
  ;[SOURCE_IP:SOURCE_PORT -> DEST_IP:DEST_PORT] [ERROR]: cmik_loader_fw_context_match_cb: match_cb for CMI APP XXX - UP_SERVICES_CLASSIFIER failed on context YYY, executing context ZZZ and adding the app to apps in exception;
  ;[SOURCE_IP:SOURCE_PORT -> DEST_IP:DEST_PORT] [ERROR]: cmik_loader_fw_context_match_cb: app XXX failed on context YYY;
  ;[SOURCE_IP:SOURCE_PORT -> DEST_IP:DEST_PORT] [ERROR]: up_manager_fw_handle_first_packet: cmi_context_exec_with_chain_connkey() failed;
  

Cause

Policy failed to load correctly.

Solution

This problem was fixed. The fix is included starting from:

• Check Point Quantum R82
• Jumbo Hotfix Accumulator for R81.20 starting from Take 119
• Jumbo Hotfix Accumulator for R81.10 starting from Take 183

Check Point recommends to always upgrade to the most recent version.

If you choose not to upgrade, Check Point can supply a Hotfix. Contact Check Point Support to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect CPinfo files from the Security Management Server and Security Gateways involved in the case.

Hotfix installation instructions:

Refer to sk168597 - How to install a Hotfix.

As an immediate workaround:

Install the Security Policy again on the Security Gateway / ClusterXL / Security Group object.

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

Article Properties

Access Level: General
Status: Approved by TAC
Date Created: 2024-07-16
Last Modified: 2025-12-21