This article is not relevant for R80.x.

---

Background

When text is copied from advanced text editors (e.g. Microsoft Word) and pasted into the SmartDashboard in a rule, certain non-ASCII characters are pasted as well. These non-ASCII characters (such as "à", "Ö", "ç")  will cause the policy installation to fail with various errors like "Internal error", "Load on module error", etc.
Kernel debug on the gateway in this case will show: fwloghandle_check_string: invalid char in string (ascii XXX) 

 

The rulename_check tool 

Check Point provides a special Tool for checking Check Point objects and rules for non-ASCII characters that detects the problematic rules in a more convenient way.
This Tool also prints the rule numbers, but the numbers may be incorrect in case there are VPN automatic rules 

Usage:

1. Download and unpack the rulename_check tool
   
   
2. Log in to Expert mode.
   
   
3. Run : [Expert@Hostname]# ./rulename_check

The tool will scan the $FWDIR/conf/rulebases_5_0.fws file and when it finds the rule with an invalid name, it adds the comment in the string “--INVALID RULE NAME--“.
After running the tool open SmartDashboard, search for this string and fix all names. 

Additional Options:

-f - path to a specific file
-d - delete the rulename to fix the problem. it will also mark all those rule ("--CLEAN RULE NAME--")
-r - read only mode – it will only print the result of the scan, but won't do any modification to the database.

 

CLI Procedure 

1. Connect to the command line on the Security Management Server / Multi-Domain Security Management Server.
   
   
2. Log in to Expert mode.

3. On Multi-Domain Security Management Server - switch to the context of the involved Domain Management Server:

   [Expert@HostName]# mdsenv <Domain_Name>

4. Check whether any of the defined Network Objects contains non-ASCII characters:

   [Expert@HostName]# grep -P -n "[\x80-\xFF]" $FWDIR/conf/objects_5_0.C

5. Check whether any of the defined Security Rules contains non-ASCII characters:

   [Expert@HostName]# grep -n -e "name.*(.*" -e "##.*" $FWDIR/conf/rulebases_5_0.fws -o | grep -e "["$'\x80'"-"$'\x9F'"]" -e [[:cntrl:]] -e "##"
   
   
   
   
6. [Expert@HostName]# grep -n -e "comments.*(.*" -e "##.*" $FWDIR/conf/rulebases_5_0.fws -o | grep -e "["$'\x80'"-"$'\x9F'"]" -e [[:cntrl:]] -e "##"
   
   
   
   
   
   

7. If Network Objects / Security Rules indeed contain non-ASCII characters then delete the non-ASCII characters:

   1. Collect a complete backup of the Management Server (refer to section "How to Backup" below).

      At least, backup these files:

      • $FWDIR/conf/objects_5_0.C
      • $FWDIR/conf/rulebases_5_0.fws
      
      
      Show / Hide how to backup
      

      • sk108902 - Best Practices - Backup on Gaia OS
      • sk91400 - System Backup and Restore feature in Gaia
      • sk54100 - How to back up your system on SecurePlatform
      • sk98153 - How to take snapshot of Endpoint Security Management Server database
      • sk33329 - How to exclude or include files in the Backup on SecurePlatform or Gaia OS
      • sk92570 - How to exclude logs from Provider-1 backup on Gaia
      • sk62226 - How to test Provider-1 MDS Backup file
      • Gaia Administration Guide (R76, R77):
        
        • Chapter 10 'Maintenance' - System Configuration Backup
      • SecurePlatform Administration Guide (R76, R77):
        
        • Chapter 4 'Configuration Using the Web Interface' - Device - Backup
        • Chapter 7 'SecurePlatform Shell' - System Commands - backup
        • Chapter 7 'SecurePlatform Shell' - Snapshot Image Management
      • Multi-Domain Security Management Administration Guide (R76, R77):
        
        • Chapter 12 'Multi-Domain Security Management Commands and Utilities' - Command Line Reference - cma_migrate
        • Chapter 12 'Multi-Domain Security Management Commands and Utilities' - Command Line Reference - mds_backup
        • Chapter 12 'Multi-Domain Security Management Commands and Utilities' - Command Line Reference - mds_restore
      • Installation and Upgrade Guide (R76, R77 Gaia, R77 Non-Gaia):
        
        • Chapter 'Upgrading Multi-Domain Security Management' - Upgrade Multi-Domain Security Management Tools - migrate export
        • Chapter 'Upgrading Multi-Domain Security Management' - Upgrade Multi-Domain Security Management Tools - cma_migrate
        • Chapter 'Upgrading Multi-Domain Security Management' - Upgrade Multi-Domain Security Management Tools - Backup and Restore

   2. Login to SDB and search for the object/rule name/comments that contains the non-ASCII character based on the above command output. Delete non-ASCII character and then push policy.                                                                                                                                                                                                                           "OR"

   3. Stop Check Point services:

      • On Security Management Server:

        [Expert@HostName]# cpstop
        
        

      • On Multi-Domain Security Management Server:

        [Expert@HostName]# mdsstop_customer <Domain_Name>
      
      
      
   4. Edit the relevant file in Vi editor ($FWDIR/conf/objects_5_0.C and/or $FWDIR/conf/rulebases_5_0.fws)
      
      
   5. Delete the non-ASCII characters in the relevant lines (refer to the output of the 'grep' command).
      
      
   6. Save the changes in the file and exit from the Vi editor.

   7. Start Check Point services:

      • On Security Management Server:

        [Expert@HostName]# cpstart
        
        

      • On Multi-Domain Security Management Server:

        [Expert@HostName]# mdsstart_customer <Domain_Name>
   
   
   
8. Connect with SmartDashboard to Security Management Server / Domain Management Server.
   
   
9. Install the policy onto the relevant Security Gateway / Cluster object.

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

This solution is about products that are no longer supported and it will not be updated