topic Re: What could be the reason behind this drop? in Firewall and Security Management

What could be the reason behind this drop?

Blason_R — Fri, 27 Aug 2021 12:07:13 GMT

Hi Team, This is R80.20 and my packets are getting dropped with below error which I captured using fw ctl zdebug. There is a PBR configured on firewall for source IP x.x.x.x for Internet as destination.

Surprisingly web traffic works fine however only ICMP is getting dropped. Any reason why? I tried searching through lot of SKs however none of them was pinpoint to the below error neither any one has worked

@;3779257712;[cpu_3];[fw4_0];fw_log_drop_ex: Packet proto=1 x.x.x.x:2048 -> 8.8.8.8:63298 dropped by fw_filter_chain Reason: [NTUP] returned Drop for reused conn;
@;3779396743;[cpu_3];[fw4_0];fw_log_drop_ex: Packet proto=1 x.x.x.x:2048 -> 8.8.8.8:63297 dropped by fw_filter_chain Reason: [NTUP] returned Drop for reused conn;
@;3779497504;[cpu_3];[fw4_0];fw_log_drop_ex: Packet proto=1 x.x.x.x:2048 -> 8.8.8.8:63296 dropped by fw_filter_chain Reason: [NTUP] returned Drop for reused conn;
@;3779590799;[cpu_3];[fw4_0];fw_log_drop_ex: Packet proto=1 x.x.x.x:2048 -> 8.8.8.8:63295 dropped by fw_filter_chain Reason: [NTUP] returned Drop for reused conn;

Re: What could be the reason behind this drop?

the_rock — Fri, 27 Aug 2021 12:11:25 GMT

I had seen this before be caused by securexl. If you disable it and it works, then below would apply.

Permanently set the value of kernel parameter fwconn_set_esp_after_nat_links to 1 (one) - follow sk26202 (Changing the kernel global parameters for Check Point Security Gateway).

Andy

Re: What could be the reason behind this drop?

Blason_R — Fri, 27 Aug 2021 12:19:01 GMT

Yeah initially I thought so hence I had disabled securexl as well however it did not work. fwaccel off is the only thing that I need to do?

Re: What could be the reason behind this drop?

the_rock — Fri, 27 Aug 2021 12:40:09 GMT

Thats all I found, sorry brother.

Re: What could be the reason behind this drop?

Timothy_Hall — Fri, 27 Aug 2021 23:14:13 GMT

ICMP is never accelerated by SecureXL and always goes F2F, so disabling SecureXL shouldn't have any effect on this issue. I'm assuming this has something to do with Smart Connection Reuse, although it isn't employed for non-TCP connections/sessions, at least to my knowledge: sk24960: "Smart Connection Reuse" feature modifies some SYN packets

Re: What could be the reason behind this drop?

the_rock — Fri, 27 Aug 2021 23:07:58 GMT

True true...I remember having to do that sk once before when customer upgraded from R80.20 to R80.30, but never related to errors in the post.

Re: What could be the reason behind this drop?

Blason_R — Tue, 31 Aug 2021 05:07:27 GMT

Any way I now removed the PBR and it started working fine.