# SIC reset: when install says Not Trusted Source: https://ai.techclick.in/blog_checkpoint_sic_reset_not_trusted Markdown: https://ai.techclick.in/blog_checkpoint_sic_reset_not_trusted.md Publisher: Techclick Infosec Pvt Ltd SIC is the trust channel. Reset the one-time activation key on the gateway, re-establish Communication in SmartConsole, then install. Dummy lab cp-gw-01. ## The ticket You published. Install Policy on cp-gw-01 fails: SIC / Not Trusted . HR is still on yesterday’s policy. Rebuilding the rulebase will not fix a broken certificate trust. Quick interview answer SIC (Secure Internal Communication) is the trusted channel between Security Management and the Security Gateway. Reset the one-time activation key on the gateway, then initialize Communication on the gateway object with that same key. Then install. Hero · broken trust Not Trusted means the SMS–gateway certificate channel, not “the user is untrusted.” Lab data · dummy only SMS sms-lab 10.10.10.5 · cluster VIP 10.10.10.1 ( cp-gw-01 10.10.10.2 / cp-gw-02 10.10.10.3 ) · external 203.0.113.25 · internal LAN 10.20.30.0/24 · HR PC 10.20.30.80 TECHCLICK\priya.hr · HR app 10.20.30.41 hr.techclick-lab.in . Not a live customer. ## What SIC is On first add, the gateway gets a one-time activation key . SMS uses it to issue a SIC certificate. After that, policy fetch, status, and often logs ride that trust. R81 CLI: cp_conf sic init <Activation Key> [norestart] resets that key. Optional norestart skips restarting Check Point services — use only when a Check Point SK says it is safe for your case. Classic GUI path: on the gateway, cpconfig → Secure Internal Communication → reset. In SmartConsole: gateway object → General Properties → Communication → Reset → enter the new key → Initialize → wait for Communicating . ## Reset vs wait Symptom Do this Do not SIC Not Trusted / Uninitialized Reset key on GW, Communication on object Edit Access rules Another admin session lock Lesson 15 — discard leftover session Reset SIC One cluster member only Reset that member, keep the other Reset both blindly Routing to SMS down Fix Gaia route first (lesson 2) Reset SIC on a box that cannot ping 10.10.10.5 smartconsole://sms-lab/gateways/cp-gw-01/communication Training mock · not live SmartConsole · lab Gateways & Servers Security Policies Logs & Monitor Manage & Settings Gateways & Servers → cp-gw-01 → Communication ### Trusted Communication One-time password •••••••• (lab key, never a customer PSK) SIC Status Uninitialized Trust state Not Trusted Cancel OK R81 CLI Reference cp_conf sic + SmartConsole Communication. Training mock. ## Reset runbook - #### Side A — prove it is SIC Ping 10.10.10.5 from the gateway. Confirm the install error is SIC / Not Trusted, not FWM lock. - #### Side B — gateway Expert: cp_conf sic init LabKey2026 (dummy key) or cpconfig SIC reset. Agree to restart services if prompted. - #### Side C — SmartConsole Gateway object → Communication → Reset → same key → Initialize → Communicating → Install Policy. Gateway · dummy # After Gaia can ping SMS cp_conf sic init LabKey2026 # Resets the one-time SIC activation key (R81 CLI Reference) # Optional status-style check after services return cpstat fw # Then in SmartConsole Communication: Communicating ## Four SIC failures ### 1 · Key mismatch You typed LabKey2026 on the gateway and LabKey2025 in SmartConsole. Initialize stays red. Re-enter the same string both sides. Keys are case-sensitive. ### 2 · Reset SMS thinking, not the gateway SIC reset is on the gateway (or the member). Do not run random SIC reset on the SMS CA unless a SK tells you to rebuild the whole trust. ### 3 · Routing / anti-spoof SIC packets never arrive. Same as lesson 2. tcpdump on Mgmt shows no 18191/18210-style management traffic (ports vary by version — confirm with current SK if you filter). ### 4 · Reset during a healthy lock Install failed because of fwm lock / leftover session (lesson 15). SIC was Communicating the whole time. Wrong fix Do not rebuild the gateway object from scratch unless Communication initialize cannot recover. Recreating the object loses SIC and often NAT/VPN references. ## How to prove it Close the ticket only when 1) Communication shows Communicating. 2) Install Policy succeeds. 3) fw stat on the member shows today’s policy. 4) One HR browse works. ## Traps Symptom Likely SIC story First proof Wrong fix Not Trusted Key or cert out of sync Communication status New Access rule Uninitialized after rebuild Never clicked Initialize Object Communication cpstop on SMS Only member 2 fails That member’s SIC cphaprob + that member Communication Reset member 1 too ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 Install Policy says Not Trusted. What is broken? Hide NAT The SIC trust channel between SMS and the gateway CoreXL Priya’s password Correct: b . Concept. Q2 R81 command to reset the one-time SIC activation key on the gateway? fw fetch cp_conf sic init fwaccel off cphastop Correct: b . R81 CLI Reference cp_conf sic. Q3 After resetting the key on the gateway, what is the SmartConsole click? Install Database only Gateway object → Communication → Reset / Initialize with the same key Delete the gateway object Logs & Monitor → Purge Correct: b . Runbook Side C. Q4 SIC Status you need before Install Policy? Uninitialized Communicating Unknown Standby Correct: b . Proof checklist. Q5 Gateway cannot ping SMS. You reset SIC anyway. What happens? SIC heals the route Initialize still fails — fix Gaia routing first ClusterXL adds a default route Policy installs offline Correct: b . Failure 3 / lesson 2. Q6 Install failed and another admin left a session. First check? Always reset SIC Check for fwm lock / leftover session (lesson 15) before touching SIC Factory reset Gaia Disable Identity Awareness Correct: b . Failure 4. Check answers Reset Check Point class series: Architecture · Gaia first day · SIC reset · Objects + first match · Policy layers · Hide vs Static NAT · Identity Awareness · HTTPS Inspection · Threat Prevention · Find the drop · fw monitor · SecureXL · ClusterXL · VPN Community · Policy install lock · vs PA vs Forti · CCSA / CCSE interview ## Sources - R81 CLI Reference — cp_conf sic — init [norestart] . - Installation / Security Management guides — Communication button on the gateway object, one-time activation key. - Vendor SKs on SIC reset (search current SK for your train; classic path is cpconfig SIC). Related: Check Point evidence desk · session factory · next lesson in the series above. --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt