I85PREP
⌘ K
CCTE R81.20 study materials
CCTE R81.20 study resources

CCTE R81.20: Management Server and SmartConsole Troubleshooting

CCTE R81.20 · Work through your exam, one topic at a time.

All guide sections

Management Server and SmartConsole Troubleshooting

Domain 2 focuses on the management plane: CPM, FWM, CPD, SIC trust, SmartConsole/API access, and policy installation. The exam expects you to separate a GUI problem from a management-server process problem and from a gateway trust problem.

Processes and service state

  • cpwd_admin list shows watched processes; confirm CPM (main management), FWM (policy), and CPD (daemon/SIC) are running.
  • cpstart and cpstop restart the management stack; use only after collecting logs, because restart clears transient state.
  • Check cpstat mg for management status and cpstat os for disk, memory, and CPU. A full /var/log or /opt partition breaks logging, policy installs, and GUI sessions.
  • Read $CPDIR/log/cpm.elg, $CPDIR/log/cpd.elg, and $FWDIR/log/fwm.elg for startup, certificate, and policy errors.

SmartConsole and API access

  • Verify SmartConsole build compatibility with R81.20 and that the client resolves the management name/IP correctly.
  • SmartConsole uses HTTPS; test with a browser or API call to distinguish GUI client faults from server faults.
  • If mgmt_cli works but SmartConsole fails, suspect the client installation, certificate trust, or local cache.
  • Check that the management interface and hostname used in the certificate match; a certificate mismatch often appears after an IP or hostname change.

SIC and policy installation

  • SIC must be established before a gateway can fetch policy. Use cpconfig > Test SIC Status; a failed SIC points to CPD, certificate, or connectivity.
  • Policy install failures often come from SIC, policy verification, license, or disk space, not from the gateway data plane.
  • fw stat on the gateway shows the installed policy name and date; compare it with the management's last install.

Worked example

After an upgrade, SmartConsole login fails but SSH to the management works. Run cpwd_admin list: CPM is down. Check $CPDIR/log/cpm.elg and find a certificate/keystore error. Test the API locally; if it also fails, the problem is server-side. Restore the certificate/keystore from backup, start CPM, then verify cpstat mg. If login succeeds but policy install fails, test SIC to each gateway before changing policy.

Traps

  • Restarting all services before reading CPM/FWM logs.
  • Confusing Install Database with Install Policy.
  • Diagnosing a gateway data-plane issue when the management cannot push policy.
  • Ignoring disk space and time skew.
  • Assuming an API success proves SmartConsole client health.