topic Re: R81.20 JHF41 TCP Handshake counter fills up in Firewall and Security Management

R81.20 JHF41 TCP Handshake counter fills up

Mikael — Tue, 06 Feb 2024 16:00:33 GMT

Hello,

Has anyone else seen this issue where the TCP Handshake and connections counter seems to fill up the 64-bit counter?

We have seen this on multiple customers, all running R81.20 JHF41 and it seems to affect both regular clusters as well as VSX VS's.

I found this while troubleshooting an issue where the customer reported traffic drops while pushing policy...

Cheers

Re: R81.20 JHF41 TCP Handshake counter fills up

the_rock — Tue, 06 Feb 2024 18:23:39 GMT

I believe its known problem. I also seen it myself and mentioned to TAC on an unrelated case and guy said they were aware. I never opened an official case, but never asked who is aware and who is working on a fix. He seemed to suggest its more of a cosmetic issue, but I sadly have no proof of that.

Best,

Andy

Re: R81.20 JHF41 TCP Handshake counter fills up

Mikael — Wed, 07 Feb 2024 07:36:12 GMT

Ok, good to know that I'm not alone 😀

I will open a case to have an official reference.

Cheers

Re: R81.20 JHF41 TCP Handshake counter fills up

the_rock — Wed, 07 Feb 2024 12:23:31 GMT

I agree, better get an official answer.

Best,

Andy

Re: R81.20 JHF41 TCP Handshake counter fills up

CheckPointerXL — Fri, 16 Feb 2024 16:52:14 GMT

maybe PRHF-31092 ? ( traffic drops while pushing policy)

available only on custom hotfix

Re: R81.20 JHF41 TCP Handshake counter fills up

the_rock — Sat, 17 Feb 2024 00:34:26 GMT

I think that is related to your post from end of November 2023. I dont see that PRHF listed in fixed IDs...either take 41 or 45, the latest one.

Andy

https://community.checkpoint.com/t5/General-Topics/R81-20-T26-Traffic-disruption-during-policy-installation-and/td-p/199267

Re: R81.20 JHF41 TCP Handshake counter fills up

AkosBakos — Sat, 02 Mar 2024 13:55:36 GMT

HI Mikael,

We found your article today. Let's say, same here. (we have MAESTRO)

Do we know the exact solution? We got a hotfix from TAC (fw1_wrapper_HOTFIX_R81_20_JHF_T41_844_MAIN_GA_FULL.tar) and we will install it tonight.

Does it solve the policy install problem?

Akos

Re: R81.20 JHF41 TCP Handshake counter fills up

Mikael — Sat, 02 Mar 2024 15:25:00 GMT

Not sure about the policy install issue. In our case it seems to have been solved by changing the settings to “keep all connections”. This issue with the counter filling up is still under investigation by TAC.

Re: R81.20 JHF41 TCP Handshake counter fills up

AkosBakos — Sat, 02 Mar 2024 15:37:40 GMT

Hi, we set the “keep all connections”, but this didn't solve the issue. A lot of clusters have the "rematch connections" by our customers, and they didn't report any issue.

Please post if the TAC gives a good solution. I am curious 🙂

Re: R81.20 JHF41 TCP Handshake counter fills up

Jan_Kleinhans — Mon, 25 Mar 2024 15:30:41 GMT

Hi,

do you have any solution? Do you see any log entries when traffic is dropped?

Jan

Re: R81.20 JHF41 TCP Handshake counter fills up

AkosBakos — Mon, 25 Mar 2024 15:47:52 GMT

Hi Jan,

We received a custom hotfix, for the original issue (during policy installation the connentions are dropped).

After the installation everything works as expected.

Cheers

Akos

Re: R81.20 JHF41 TCP Handshake counter fills up

Julian_Wagner — Mon, 29 Jul 2024 05:59:27 GMT

We are experiencing the same issue.
Did someone got an official answer from Check Point, or at least know if it was resolved in R81.20 Take 70?

Re: R81.20 JHF41 TCP Handshake counter fills up

AkosBakos — Mon, 29 Jul 2024 10:30:28 GMT

Hi @Julian_Wagner

It has already fixed in take 54:

PRJ-50761,

PRHF-31092

Security Gateway

On Security Gateways with enabled Hyper Flow feature, during policy installation and re-offload process of the connections, accelerated connections may be interrupted. Refer to sk181671.

Cheers

Akos

Re: R81.20 JHF41 TCP Handshake counter fills up

Bob_Zimmerman — Wed, 05 Feb 2025 12:49:23 GMT

I just saw this on some R81.20 jumbo 76 systems. The reported value, 18,446,744,073,709,552,000, is actually a little higher than would fit in a 64-bit counter. It's 2^64 + 2^8 + 2^7. Definitely some kind of bug.

Re: R81.20 JHF41 TCP Handshake counter fills up

David_Evans — Wed, 23 Jul 2025 14:46:43 GMT

Has anyone gotten a solution to the handshake counter specifically?

Its been on and off again across our infrastructure on R81.10 and R81.20 on Maestro and non Maestro firewalls. It actually seems to be getting worse and not better up through Jumbo 105.