ICAP enabled TE100X emulation fails with "There was an Unexpected Internal error, Please try again later"

Product: Threat Emulation
Version: R81.10 (EOS), R81.20, R82
OS: Gaia
Platform: TE
Last Modified: 2025-12-29

Symptoms

• Threat Emulation solution on the ICAP Server fails with " There was an Unexpected Internal error, Please try again later".
• Slowness or complete failure to load certain web pages, especially during login to external sites (such as Cisco login).
• The Server sends requests or files to be scanned by Harmony Browse (Threat Emulation TE100X) through ICAP, but does not receive responses at random intervals.
• ICAP flags general traffic as Virus or Scan Error, causing legitimate traffic to be blocked. And " Virus_detected in the content (virus_detected)" message appears while browsing, logs show files are blocked.
• High CPU spikes are observed on the C-ICAP process during the issue.
• Bypassing traffic using Proxy or disabling Threat Emulation Software Blade in the Threat Prevention policy resolves the issue.

Cause

During the ICAP scanning flow, the system reports an internal error rather than returning a valid scan result (clean, infected, or scan error verdict) to the requesting service.

Solution

This problem was fixed. The fix is included in:

• Jumbo Hotfix Accumulator for R82 starting from Take 60
• Jumbo Hotfix Accumulator for R81.20 starting from Take 120
• Jumbo Hotfix Accumulator for R81.10 starting from Take 183

If you choose not to upgrade, Check Point can supply a Hotfix. Contact Check Point Support to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect CPinfo files from the Security Management Server and Security Gateways involved in the case.

Hotfix installation instructions:

Refer to sk168597 - How to install a Hotfix.

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

Article Properties

Access Level: General
Status: Approved by TAC
Date Created: 2025-11-15
Last Modified: 2025-12-29