topic Re: Mgmt traffice cannot cross bridge interface (double-inspection) in Firewall and Security Management

Mgmt traffice cannot cross bridge interface (double-inspection)

Alvin — Mon, 19 Apr 2021 04:30:05 GMT

Hello anyone,

I hope that the Mgmt interface update signature traffic can traverse the bridge interface of the same Security Gateway, I refer to SK105899, and add the following kernel data,

[Expert@R81:0]# cat $PPKDIR/boot/modules/simkern.conf
# Deprecated location.
# Any change should be made at /opt/CPppak-R81/conf/simkern.conf
sim_anti_spoofing_enabled=0
[Expert@R81:0]# cat $FWDIR/boot/modules/fwkern.conf
fw_local_interface_anti_spoofing=0
fw_antispoofing_enabled=0
fwx_bridge_reroute_enabled=1

At this point, I still cannot update, and I get the following message (fw ctl zdebug + drop)

@;3558;[cpu_1];[fw4_2];fw_log_drop_ex: Packet proto=6 172.16.13.192:43355 -> 96.7.254.216:443 dropped by fw_reroute_bridge_fold Reason: Bridge reroute, cksum is wrong;
@;3565;[cpu_1];[fw4_2];fw_log_drop_ex: Packet proto=6 172.16.13.192:43355 -> 96.7.254.216:443 dropped by fw_reroute_bridge_fold Reason: Bridge reroute, cksum is wrong;
@;3578;[cpu_1];[fw4_2];fw_log_drop_ex: Packet proto=6 172.16.13.192:43355 -> 96.7.254.216:443 dropped by fw_reroute_bridge_fold Reason: Bridge reroute, cksum is wrong;
@;3604;[cpu_1];[fw4_2];fw_log_drop_ex: Packet proto=6 172.16.13.192:43355 -> 96.7.254.216:443 dropped by fw_reroute_bridge_fold Reason: Bridge reroute, cksum is wrong;
@;3680;[cpu_2];[fw4_1];fw_log_drop_ex: Packet proto=6 172.16.13.192:26677 -> 96.7.254.216:443 dropped by fw_reroute_bridge_fold Reason: Bridge reroute, cksum is wrong;
@;3686;[cpu_2];[fw4_1];fw_log_drop_ex: Packet proto=6 172.16.13.192:26677 -> 96.7.254.216:443 dropped by fw_reroute_bridge_fold Reason: Bridge reroute, cksum is wrong;
@;3699;[cpu_2];[fw4_1];fw_log_drop_ex: Packet proto=6 172.16.13.192:26677 -> 96.7.254.216:443 dropped by fw_reroute_bridge_fold Reason: Bridge reroute, cksum is wrong;
@;3725;[cpu_2];[fw4_1];fw_log_drop_ex: Packet proto=6 172.16.13.192:26677 -> 96.7.254.216:443 dropped by fw_reroute_bridge_fold Reason: Bridge reroute, cksum is wrong;

I am currently running R81 GA version, and the problem also occurs in R80.40
Can anyone assist me in solving this problem?

Re: Mgmt traffice cannot cross bridge interface (double-inspection)

PhoneBoy — Mon, 19 Apr 2021 18:50:46 GMT

Recommend a TAC case here.

Re: Mgmt traffice cannot cross bridge interface (double-inspection)

chinchira — Fri, 27 Jan 2023 11:41:50 GMT

I am having a similar problem where am getting the same drop message. Please share how this was resolved.

Thanks.

Re: Mgmt traffice cannot cross bridge interface (double-inspection)

Chris_Atkinson — Fri, 27 Jan 2023 15:50:19 GMT

Did you already try the solution from SK105899?

Double-inspection is otherwise not supported by SXL (sk172204) and you should review the topology/routing.

Re: Mgmt traffice cannot cross bridge interface (double-inspection)

chinchira — Sat, 28 Jan 2023 07:48:22 GMT

We have done all the changes as advised by this SK105899. I suspect this kernel parameter 'fwx_bridge_reroute_enabled=1' could be the cause, but I stand to be guided. Maybe you can also expound more on what this parameter does. What would be gateway behavior if we remove this parameter?

Unfortunately topology change is not possible in the short-term, hence why we are looking for a solution on Checkpoint itself.

Re: Mgmt traffice cannot cross bridge interface (double-inspection)

AkosBakos — Thu, 20 Apr 2023 08:50:40 GMT

Hi Chinchira,

I got the same error message. Do you have solution for this?

Thanks in advance,

Akos

Re: Mgmt traffice cannot cross bridge interface (double-inspection)

G_W_Albrecht — Thu, 20 Apr 2023 09:00:45 GMT

I would recommend a TAC case here.

Re: Mgmt traffice cannot cross bridge interface (double-inspection)

AkosBakos — Thu, 20 Apr 2023 09:50:10 GMT

Hi,

I hope this issue will be solved quickly. 🙂

Akos

Re: Mgmt traffice cannot cross bridge interface (double-inspection)

AkosBakos — Mon, 24 Apr 2023 16:51:03 GMT

It seems the issue have been solved:

We use only 2 out of the 4 kernerparameters (why should we use not relevant key-pairs??)

https://support.checkpoint.com/results/sk/sk105899

fw_local_interface_anti_spoofing=0

fw_antispoofing_enabled=0

fwx_bridge_reroute_enabled=1

fwx_perform_gateway_hide=0

Conclusion: all of the four key-pairs are needed