topic Re: TCP out of state drop observed before the timeout configured in firewall in Firewall and Security Management

TCP out of state drop observed before the timeout configured in firewall

praveshnayal — Fri, 07 Oct 2022 18:29:47 GMT

Hello all,

We have encountered TCP out of state drops stating First Packet isn't SYN just after 10 mins of the connection initiation from the source. (After inactivity)

The timeout configured in the service port is default 3600 seconds so as per my understanding the connection entry should be there on the firewalls for 1 hour but in this case once the user returns to the application after 10 minutes the user gets disconnected and we can see out of state drop logs as mentioned above.

What could be the possible reasons for this behaviour?

Thanks for any suggestions in advance.

Re: TCP out of state drop observed before the timeout configured in firewall

PhoneBoy — Fri, 07 Oct 2022 18:53:45 GMT

Version/JHF of gateway involved?
What is the precise service in question?
Have you performed any tcpdumps to see what the application is doing during this time?

Re: TCP out of state drop observed before the timeout configured in firewall

Chris_Atkinson — Sat, 08 Oct 2022 13:35:32 GMT

How is the memory utilisation of the appliance, any signs that aggressive aging has been activated?

Re: TCP out of state drop observed before the timeout configured in firewall

Cihat_Bulut — Mon, 10 Oct 2022 15:06:27 GMT

If it is R81.10 JHF 66, then R&D is working on it. The fix will be soon.

Re: TCP out of state drop observed before the timeout configured in firewall

Tobias_Moritz — Tue, 11 Oct 2022 07:28:44 GMT

Did you do a policy install between establishing the connection and "the user returns to the application after 10 minutes"?

If yes, then you can check sk103598 to see if you match a scenario from there.

Re: TCP out of state drop observed before the timeout configured in firewall

Cihat_Bulut — Tue, 11 Oct 2022 18:33:47 GMT

From R&D;

We have a new workaround to be implemented on the GW:

Please run # fw ctl set int fw_tcp_enforce_half_closed_timeout 1

Install policy.

Re: TCP out of state drop observed before the timeout configured in firewall

Infrastructure3 — Thu, 13 Oct 2022 11:57:24 GMT

Hi Cihat,

Is there some SK article regarding this or logged as open bug somewhere to read more details of this condition?

Re: TCP out of state drop observed before the timeout configured in firewall

PhoneBoy — Fri, 14 Oct 2022 16:28:03 GMT

A little more details here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137672