topic Re: "CPNotEnoughDataForRuleMatch" and "Connection terminated..." in Firewall and Security Management

"CPNotEnoughDataForRuleMatch" and "Connection terminated..."

JPR — Wed, 23 Oct 2024 09:57:51 GMT

Hi all,

I am seeing a lot of “Connection terminated before detection: Insufficient data.” and “Connection terminated before detection: No SSL applicative data.“ and the matched rule “CPNotEnoughDataForRuleMatch” on my gateway and it worries me a little.

When I perform a simple search for logs with those fields in combination in our SIEM in 24 hour time frame I get quite a lot as seen below:

I've checked out the sk113479 and it states that: “No fix is required. This behavior is by design.”, but I still find it a bit odd.

Below is an actual log from the gateway:

And the matched rule:

The gateway seems to work as it should, but it just seems as a fairly large amount of hits and I’m just worried we have some kind of misconfiguration on our gateway.

Appliance is 6400 running 81.20 Take 84.

Any comments or ideas are welcome!

Thanks.

Re: "CPNotEnoughDataForRuleMatch" and "Connection terminated..."

the_rock — Wed, 23 Oct 2024 11:56:34 GMT

I know it sounds odd, but it is 100% normal.

Refer to below.

Andy

https://community.checkpoint.com/t5/Security-Gateways/CPNotEnoughDataForRuleMatch/m-p/198942#M37254

https://community.checkpoint.com/t5/General-Topics/When-does-CPEarlyDrop-occur-with-ACCPET-action/m-p/216402#M35976

https://community.checkpoint.com/t5/Security-Gateways/weird-behaviour/m-p/220375

Re: "CPNotEnoughDataForRuleMatch" and "Connection terminated..."

PhoneBoy — Wed, 23 Oct 2024 15:39:02 GMT

The reason this occurs is simple: some level of rulebase matching must occur on the first packet.
All you know from the initial TCP SYN for policy matching purposes is:

Source IP
Destination IP
Destination Port Number

Knowing the exact applications used requires allowing some additional packets after the three-way handshake.
If the connection terminates before that determination is done (usually doesn't take more than a few packets), you'll see this error.

Like the SK says, it's perfectly normal, expected behavior.

Re: "CPNotEnoughDataForRuleMatch" and "Connection terminated..."

the_rock — Wed, 23 Oct 2024 16:26:53 GMT

Here is, in my opinion, the BEST explanation for it, provided by @Bob_Zimmerman in 2nd link I gave you.

Andy

This message means the firewall isn't the problem. It allowed the SYN, but the connection was closed for some other reason before the firewall could see the website or application being attempted.

This is almost always because the server didn't respond with a SYN-ACK.

Re: "CPNotEnoughDataForRuleMatch" and "Connection terminated..."

JPR — Thu, 24 Oct 2024 11:09:01 GMT

Okay, thanks to you both. That calms my nerves a lot 🙂

So in your opinion I shouldn't be alarmed about the amount logs regarding this either? We're a company of around 650 internal users.

Re: "CPNotEnoughDataForRuleMatch" and "Connection terminated..."

the_rock — Thu, 24 Oct 2024 13:11:00 GMT

I dont think you should be.

Andy