topic Re: Disabling "Drop out of state TCP packets" on a host by host basis. R81.10 HF87 in Firewall and Security Management

Disabling "Drop out of state TCP packets" on a host by host basis. R81.10 HF87

AaronPW — Sun, 29 Oct 2023 17:58:41 GMT

Hello. Due to an asymmetrical routing issue inherent in the design of our VOIP network I am trying to find out how I can disable this check for certain hosts or the entire VOIP network if necessary. I see the option in Global Properties but I am trying to only disable this for some hosts that connect over an MPLS connection at each site.

I know we need to redesign things so we don't have this issue but that is not an option at the moment.

Re: Disabling "Drop out of state TCP packets" on a host by host basis. R81.10 HF87

AaronCP — Sun, 29 Oct 2023 19:47:59 GMT

Hey,

Check out Vladimir's post in https://community.checkpoint.com/t5/Management/How-to-enable-TCP-out-of-state-exceptions-per-network-or-host/td-p/13682

Re: Disabling "Drop out of state TCP packets" on a host by host basis. R81.10 HF87

AaronPW — Sun, 29 Oct 2023 21:32:36 GMT

I'm trying that but it just isn't having any effect. I'm still seeing the drops.

Re: Disabling "Drop out of state TCP packets" on a host by host basis. R81.10 HF87

AaronCP — Sun, 29 Oct 2023 21:52:32 GMT

@AaronPW wrote:

I'm trying that but it just isn't having any effect. I'm still seeing the drops.

Have you tried modifying the INSPECT code as per https://support.checkpoint.com/results/sk/sk11088

Re: Disabling "Drop out of state TCP packets" on a host by host basis. R81.10 HF87

the_rock — Mon, 30 Oct 2023 03:14:47 GMT

I think sk @AaronCP gave you is your best bet, but if that fails, I would maybe get an official TAC response. I know couple of years ago, they actually gave me Vladimir's post as well, but that sadly did not work, so customer simply ended up unchecking the global properties option. I know, its not the best workaround, but it seemed to be the easiest one at the time.

Andy

Re: Disabling "Drop out of state TCP packets" on a host by host basis. R81.10 HF87

AaronPW — Thu, 02 Nov 2023 17:28:23 GMT

Apparently you cannot do this on a host by host basis in the way I am asking. The L3 guy said I can only do this on an entire gateway basis and not on a network by network basis. But honestly the quality of help I get from CP TAC is hit or miss so I am going to try that other method with the file modification.

Re: Disabling "Drop out of state TCP packets" on a host by host basis. R81.10 HF87

the_rock — Thu, 02 Nov 2023 17:53:19 GMT

Well, I guess an official response that only gateways there are supported. Its possible method Vladimir gave works, I never tested it myself.

Andy

Re: Disabling "Drop out of state TCP packets" on a host by host basis. R81.10 HF87

PhoneBoy — Thu, 02 Nov 2023 19:05:33 GMT

By modifying the INSPECT code as described in sk11088, you can do exclusions on a per-host/network basis.