Troubleshooting SD-WAN Installation

Symptoms:

• Output of the "cpsdwan stat" command shows no policy installed.

• Output of the "cpsdwan stat" command shows a previous policy version compared to the policy version in the output of the "cpnano -s" command.

Solution:

1. On the Security Gateway, examine the Nano-Agent status:

   1. Connect to the command line on the Security Gateway.

   2. Log in to the Expert mode.

   3. Examine the Nano-Agent status:

      cpnano -s

      Examine the lines that are highlighted in the example output below:

      • Your output must show the same statuses

      • Examine the dates

      Example:

      ---- Check Point Nano Agent ---- Version: 1.2301.472956 Status: Running Last update attempt: 2023-04-20T14:50:06.545687 Last update: 2023-04-20T14:50:06.557303 Last update status: Succeeded Policy version: 91 Last policy update: 2023-04-20T11:51:10.857490 Last manifest update: None Last settings update: 2023-04-20T11:51:10.857490 Registration status: Succeeded Manifest status: None Upgrade mode: automatic Fog address: inext-agents.cloud.ngen.checkpoint.com Agent ID: XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXX Profile ID: XXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX Tenant ID: XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXX Registration details: Name: Type: Quantum Platform: Architecture: Service policy: sdwan: /etc/cp/conf/sdwan/sdwan.policy Service settings: ---- Check Point Orchestration Nano Service ---- Type: Public, Version: 1.2301.472956, Created at: 2023-01-05T14:56:54+0200 Status: Running ---- Check Point Messaging Proxy Nano Service ---- Type: Public, Version: 1.2301.472956, Created at: 2023-01-05T14:56:54+0200 Status: Running ---- Check Point SD-WAN Nano Service ---- Type: Public, Version: 1.2301.472956, Created at: 2023-01-05T14:56:54+0200 Status: Running ---- Check Point SD-WAN Logger Nano Service ---- Type: Public, Version: 1.2301.472956, Created at: 2023-01-05T14:56:54+0200 Status: Running ---- Check Point Cpview Metric Provider Nano Service ---- Type: Public, Version: 1.2301.472956, Created at: 2023-01-05T14:56:54+0200 Status: Running

2. In Infinity Portal > Quantum SD-WAN application:

   1. Go to the Network view > SD-WAN Policy page.

   2. From the top, click WAN Link Mapping.

   3. Make sure you configured all required interfaces.

   4. Close the WAN Link Mapping window.

   5. Examine SD-WAN Policy to make sure there are no steering objects that select only a specific interface, such as "WAN 2" that has no association to an actual interface on the Security Gateway in the WAN Link Mapping window.

3. Go to the Monitor view > Events page.

4. Search for policy installation failures - examine the reason and the remediation suggestion.

5. Advanced troubleshooting on the Security Gateway:

   1. Examine the status of the "sdwan_steering" process - it must be running:

      1. Run:

         cpwd_admin list | grep -E "APP|steering"

         The "STAT" column must show "E" (executing).

      2. Run:

         ps -aux | grep sdwan_steering | grep -v grep

      3. If the process is not running, then contact Check Point Support and include this information:

         • The complete CLI outputs

         • Does the /var/log/dump/usermode/ directory contain core dump files for the "sdwan_steering" process?

         • These files:

           • $FWDIR/log/sdwan_steering.elg

           • $FWDIR/log/cpsdwan.elg

           • /var/log/nano_agent/cp-nano-sdwan.dbg

           • /var/log/nano_agent/cp-nano-orchestration.dbg

   2. Fetch the latest SD-WAN policy that was downloaded from Infinity Portal:

      cpsdwan fetch_new

   3. If fetching the latest SD-WAN policy downloaded from Infinity Portal failed, then fetch the SD-WAN policy from the local directory:

      1. Make sure there is an updated / acceptable policy version:

         cpnano -s | grep version

      2. Fetch the local policy:

         cpsdwan fetch_local

6. Examine these log files for errors:

   • $FWDIR/log/sdwan_steering.elg

   • $FWDIR/log/cpsdwan.elg

   • /var/log/nano_agent/cp-nano-sdwan.dbg

   • /var/log/nano_agent/cp-nano-orchestration.dbg

7. Contact Check Point Support and include the complete CLI outputs and log files.