topic Drops "TCP Out of Sequence" even after creating excepcions in Firewall and Security Management

Drops "TCP Out of Sequence" even after creating excepcions

arcotangente — Thu, 08 Jul 2021 14:52:31 GMT

Hi guys,

We are troubleshooting a random issue with a connection between 2 internal hosts and some external servers on a cloud provider. We don't know if it is related to the issue or not, but we observe in the firewalls logs some "TCP out of state" packet drop.

Most of the drops have "ACK" as TCP flag, and some "PUSH-ACK", as shown on the screenshots attached.

So we went to Inspection Settings and for our gateway we added the source IPs (only the source, Any destination) and the destination port (443) as exception for the protection "TCP out of Sequence". However nothing has changed, and the gateways keep dropping the packets for time to time.

The gateway cluster is a 4000 series running R80.10

Any help on this?

Thanks

Re: Drops "TCP Out of Sequence" even after creating excepcions

PhoneBoy — Thu, 08 Jul 2021 15:34:07 GMT

Why R80.10 and not a later release?
Regardless a TAC case may be necessary to get to the bottom of this.

Re: Drops "TCP Out of Sequence" even after creating excepcions

arcotangente — Fri, 09 Jul 2021 10:33:56 GMT

Hi,

We haven't had any issues with R80.10 so haven't considered upgrading to a later release.

Anyway, why after we put the IP's under exceptions in the Inspection Settings these drops are still happening? is not that the right place to do it? which could be the cause of seeing many ACKs drops and some PUSH-ACKs drops?

Thanks!

Re: Drops "TCP Out of Sequence" even after creating excepcions

PhoneBoy — Sat, 10 Jul 2021 00:02:14 GMT

Per our original schedule, R80.10 should be End of Support by now, but we extended it to January 2022.
There are numerous improvements in more recent releases.

In any case, you're modifying a protection related to TCP sequence numbers, which has nothing to do with this.
What you probably want to do is: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk11088