topic Re: Connection terminated before the Security Gateway was able to make a decision in Firewall and Security Management

Connection terminated before the Security Gateway was able to make a decision

Gacki — Thu, 16 Mar 2023 12:26:16 GMT

Hello,

I have a problem that the idream.pl website works properly inside the company, but if there is a VPN access to the website, unfortunately a too long wait message pops up, the checkpoint logs show what is in the connector.

A rule is made that should allow access to this page.

Re: Connection terminated before the Security Gateway was able to make a decision

Chris_Atkinson — Thu, 16 Mar 2023 12:30:03 GMT

Have you already reviewed sk113479?

Re: Connection terminated before the Security Gateway was able to make a decision

Gacki — Thu, 16 Mar 2023 12:36:19 GMT

yes, but i didn't find the answer there.

my error is

Connection terminated before detection: Insufficient data. <X> bytes passed

Data packets have arrived, but the amount of data was not enough for the engine detection. The string will also state the number of data bytes (TCP/UDP payload) that may pass the Gateway.

now the question is how can i solve it?

Re: Connection terminated before the Security Gateway was able to make a decision

the_rock — Thu, 16 Mar 2023 12:50:20 GMT

I had this happen with customer before and TAC told us that sk simply states its not CP issue, to make a long story short : - ). I actually agree with that, because logically, connection gets terminated, but there is proof anywhere its the fw causing it.

You definitely need to run some captures and confirm whats happening with the traffic.

Andy

Re: Connection terminated before the Security Gateway was able to make a decision

Gacki — Thu, 16 Mar 2023 13:04:22 GMT

Can you suggest how best to capture this traffic? additionally wireshark? or on the checkpoint side?

Re: Connection terminated before the Security Gateway was able to make a decision

the_rock — Thu, 16 Mar 2023 13:25:20 GMT

Lets do remote if you are allowed and I can help you. If not, please provide the source/dst IP addresses with ports/protocol involved and I can send you the captures you need.

Cheers mate.

Andy

Re: Connection terminated before the Security Gateway was able to make a decision

Gacki — Thu, 16 Mar 2023 13:32:29 GMT

we are trying to connect to idream.pl (137.74.1.35) http (TCP/80)

Re: Connection terminated before the Security Gateway was able to make a decision

the_rock — Thu, 16 Mar 2023 13:33:40 GMT

K, cool. Can you please give me one source IP you are testing from, so I can give you right capture flags?

Cheers,

Andy

Re: Connection terminated before the Security Gateway was able to make a decision

Gacki — Thu, 16 Mar 2023 13:35:45 GMT

10.10.12.16

Re: Connection terminated before the Security Gateway was able to make a decision

the_rock — Thu, 16 Mar 2023 13:41:57 GMT

fw monitor -e "accept host(137.74.1.35);"
fw monitor -e "accept host(137.74.1.35) and port(80);"
fw monitor -e "accept host(137.74.1.35) and host(10.10.12.16);"
tcpdump -nni any host 137.74.1.35
fw monitor -F "10.10.12.16,0,137.74.1.35,80,0"
fw monitor -F "10.10.12.16,0,137.74.1.35,80,0" -F "137.74.1.35,0,10.10.12.16,80,0"

Just as a side note, though you already probably know this, tcpdump will NOT show you any inspection points taking place, simply if traffic is hitting any interface on the firewall, but fw monitor would show you those things.

Andy

Re: Connection terminated before the Security Gateway was able to make a decision

Gacki — Thu, 16 Mar 2023 14:22:43 GMT

i.e. it's not a checkpoint problem, but something before the checkpoint is causing not all data packets to arrive

Re: Connection terminated before the Security Gateway was able to make a decision

the_rock — Thu, 16 Mar 2023 14:27:16 GMT

Correct and that sk is literally LONG way of simply saying "This is not Check Point issue" 🙂