Check Point SIC Reset: cp_conf sic When Policy Install Says 'Not Trusted'

Check Point · Techclick CLI troubleshooting lab

Policy install to a gateway fails with SIC error. The gateway is otherwise forwarding old policy.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

• Name the first CLI command to run on Check Point for this ticket

• Separate the layer that is actually broken from the layer people blame

• Apply one scoped fix instead of a global disable

• Prove the ticket closed with a session, log, or counter

Quick answer

SIC is the trust channel. Reset SIC on the gateway, re-establish from SmartConsole with the activation key, then install.

Why this ticket shows up

A reimage, a cloned VM, or a changed management IP breaks SIC. Data plane can still run the last policy.

Symptoms operators actually see

• Not trusted / SIC error

• cpstat on management cannot poll

• After VM clone

• Management IP changed

CLI first — copy this block

Run these on the Check Point device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

cpstat fw
cp_conf sic state
cp_conf sic init <activation-key> norestart
cpwd_admin list
fw stat

How to read that output

sic state must be initialized and then established from the manager. fw stat still showing an old policy is expected until SIC is back.

Triage order

1. Note the current policy name

2. Init SIC on the gateway

3. In SmartConsole, reset SIC and enter the same key

4. Wait for established

5. Install policy

Classic traps

What you see	Real cause	Fix
Reinstall the whole gateway	Only SIC is broken	Reset SIC
Change the SIC name casually	Name is part of trust	Keep the object name
Push policy anyway	It will keep failing	Fix SIC first

Proof the ticket is closed

• SIC established

• Policy install succeeds

• fw stat shows the new policy

Say this in an interview

A forwarding gateway with a SIC error is running yesterday's policy. I reset SIC, I do not rebuild the box.

---

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/