topic Re: sk175289 SIP Traffic is Dropped With Drop Message "dropped by cphwd_cpasglue_handle_packet in Firewall and Security Management

sk175289 SIP Traffic is Dropped With Drop Message "dropped by cphwd_cpasglue_handle_packet Reason: C

David_Powers1 — Thu, 04 Nov 2021 13:17:00 GMT

We have a gateway that is currently being impacted by the issue presented in this SK.

Wondering when we might expect the fix for this to be rolled in to the R80.40 GA JHF.

Re: sk175289 SIP Traffic is Dropped With Drop Message "dropped by cphwd_cpasglue_handle_packet

mcatanzaro — Fri, 05 Nov 2021 03:22:58 GMT

Hi David,

Responding as I wrote that SK so I am familiar with this issue 🙂.

Unfortunately, I can't give you a timeframe as to when it will make a jumbo.

Your best bet will be to open a support ticket and request a private fix if TAC verifies the issue against your environment.

Re: sk175289 SIP Traffic is Dropped With Drop Message "dropped by cphwd_cpasglue_handle_packet

David_Powers1 — Sun, 07 Nov 2021 06:20:14 GMT

Thanks for the reply, we did that at the same time.
Pending a response

Re: sk175289 SIP Traffic is Dropped With Drop Message "dropped by cphwd_cpasglue_handle_packet

Pedro_Madeira — Mon, 06 Mar 2023 11:21:24 GMT

Hello,

Any news when will this particular hotfix will be included in a Jumbo?

I have a large customer which is always facing this issue and the solution, in the past, is to open a TAC SR and ask for the hotfix port for the current JHFA installed on this customer.

We're currently riding R81.10 JHFA T78 and we're still encountering this problem.

@;2609566246;[cpu_15];[fw4_1];fw_log_drop_ex: Packet proto=17 aaa.bbb.ccc.ddd:21016 -> www.xxx.yyy.zzz:28052 dropped by cphwd_cpasglue_handle_packet Reason: CPAS: failed to init streamh;

My current plan is to upgrade to JHFA T87 and ask for the portfix but it would be nice to see this resolution included in the mainstream jumbo take.

Thanks,

Pedro Madeira

Re: sk175289 SIP Traffic is Dropped With Drop Message "dropped by cphwd_cpasglue_handle_packet

G_W_Albrecht — Mon, 06 Mar 2023 12:06:22 GMT

According to https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/R81.10/R81.10-List-of-all-Resolved-Issues.htm , the fix for sk177025 is included since Take 38. TAC should be consulted here, i think...

Re: sk175289 SIP Traffic is Dropped With Drop Message "dropped by cphwd_cpasglue_handle_packet

Pedro_Madeira — Mon, 06 Mar 2023 12:12:24 GMT

Hi,

Hope you're good.

Yeah, it's a strange thing then since I'm still seeing the issue in JHFA T78.

I'm waiting for the confirmation from the customer to upgrade to JHFA T87 and then I'm planning on opening a new SR to see what they think.

If I do a fw ctl zdebug, I can see the exact same drops I was seeing in previous major versions and those were only solved with a specific porfix installed on top of the jumbo.

But it was a good find, because I was not finding any references in the fixed issues of the jumbo, for this particular problem.

And you're absolutely right, this should be fixed by now according to the jumbo release notes.

Re: sk175289 SIP Traffic is Dropped With Drop Message "dropped by cphwd_cpasglue_handle_packet

David_Powers1 — Mon, 06 Mar 2023 12:56:42 GMT

We are preparing to roll out R81.10 JHF87, and TAC has provided as with a ported wrapper for this issue. It would seem that the issue is not yet resolved in JHF.

Re: sk175289 SIP Traffic is Dropped With Drop Message "dropped by cphwd_cpasglue_handle_packet

Max_Frankl — Mon, 06 Mar 2023 13:19:25 GMT

Hi, can you please share the SR? I would like to look into this

Re: sk175289 SIP Traffic is Dropped With Drop Message "dropped by cphwd_cpasglue_handle_packet

David_Powers1 — Mon, 06 Mar 2023 13:24:24 GMT

6-0003523991

Re: sk175289 SIP Traffic is Dropped With Drop Message "dropped by cphwd_cpasglue_handle_packet

the_rock — Mon, 06 Mar 2023 14:35:09 GMT

I totally see where you are coming from. It would be so much more convenient if those fixed would be included in main jumbo fixes.

Re: sk175289 SIP Traffic is Dropped With Drop Message "dropped by cphwd_cpasglue_handle_packet

Pedro_Madeira — Wed, 08 Mar 2023 18:35:27 GMT

Hello Max,

Do you happen to have any results from your investigation?

For my customer, which is facing this issue, I'm planning on upgrading from R81.10 JHFA T78 to JHFA T87 and I just opened a SR 6-0003561789 to request for the portfix for this particular jumbo take.

Unless there's a different approach to take that avoids installing a specific hotfix.

Thanks in advance for any tips.

Best regards,

Pedro Madeira

Re: sk175289 SIP Traffic is Dropped With Drop Message "dropped by cphwd_cpasglue_handle_packet

Max_Frankl — Sun, 12 Mar 2023 11:55:48 GMT

Still checking sorry, when I have news I will update accordingly

Re: sk175289 SIP Traffic is Dropped With Drop Message "dropped by cphwd_cpasglue_handle_packet

AntE — Fri, 06 Oct 2023 18:35:09 GMT

Hello all,

We are also seeing the following messages in our kernel drop logs:

[1_04]@;719323853;[vs_0];[tid_5];[fw4_5];fw_log_drop_ex: Packet proto=17 aaa.bbb.ccc.ddd:6070 -> www.xxx.yyy.zzz:7222 dropped by cphwd_cpasglue_handle_packet Reason: CPAS: failed to init streamh;

We are currently running R81.10 with JHFA take 95, and I've open a TAC case regarding these messages. I guess I'm also curious if the port-fix has been included in an R81.10 jumbo at this point.

Thanks!

Re: sk175289 SIP Traffic is Dropped With Drop Message "dropped by cphwd_cpasglue_handle_packet

Pedro_Madeira — Fri, 06 Oct 2023 18:58:25 GMT

Hi there,

It's fixed in JHFA T110.

Go ahead and install it to fix the problem.

I tested this in production with success.

Good luck,

Pedro Madeira

Re: sk175289 SIP Traffic is Dropped With Drop Message "dropped by cphwd_cpasglue_handle_packet

AntE — Fri, 06 Oct 2023 19:44:05 GMT

Excellent! Thank you very much for the update! 😁

Re: sk175289 SIP Traffic is Dropped With Drop Message "dropped by cphwd_cpasglue_handle_packet

AntE — Wed, 18 Oct 2023 02:15:38 GMT

Hi Pedro,

Just wanted to confirm - we patched to JHFA Take 110 and our issue was fixed as well. Thank you very much for the information and the recommendation!

- Antonio