topic Re: UDP packet loss after installing policy R81.20 in Firewall and Security Management

UDP packet loss after installing policy R81.20

Jan_Kleinhans — Fri, 13 Dec 2024 12:00:12 GMT

Hello everybody,

is somebody experiencing packet loss in udp streams when installing policy.

We have this issue with MS Teams and also with voip traffic.

When you are in a voip call and install policy, right after the policy installation is finished the voip call begins to loose packets so that you cannot hear each other anymore or only some words.

We are using R81.20 JHF 76 or 89 and have this issue on 2 VSX Clusters (Checkpoint 19200 using UPPAK) . We have a case open for this issue since over a month now. The debugging scenario didn't work as it is to heavy for the firewalls and we experience more outages.

Maybe somebody is experiencing the same ?

Jan

Re: UDP packet loss after installing policy R81.20

Chris_Atkinson — Sat, 14 Dec 2024 22:20:00 GMT

For context how is your connection persistence currently set, any dynobjs used?

Are you still suffering Errors / Drops / Mbuf / Misses in your "show interface eth1-0X stats" output, if you chart those how do they correlate to the policy installs?

Re: UDP packet loss after installing policy R81.20

the_rock — Fri, 13 Dec 2024 13:09:35 GMT

Hey Jan,

I read what @Chris_Atkinson responded with and exact same thought came to my mind. I had seen this before and it definitely could be related to setting below. I would set it to keep all connections.

Andy

Keep all connections keeps all control and data connections open until the connections have ended. The newly installed policy will be enforced only for new connections.
Keep Data Connections keeps all data connections open until the connections have ended. Control connections that are not allowed under the new policy will be terminated.

Rematch Connections means that all connections not allowed under the new policy will be terminated, unless the service has Keep connections open after policy has been installed is enabled in the Service Properties window.

Re: UDP packet loss after installing policy R81.20

Timothy_Hall — Fri, 13 Dec 2024 14:11:32 GMT

This thread sounds like it may be relevant to your issue:

https://community.checkpoint.com/t5/Security-Gateways/Message-seen-on-var-log-messages-quot-simi-reorder-enqueue/m-p/12365

Re: UDP packet loss after installing policy R81.20

Jan_Kleinhans — Mon, 16 Dec 2024 08:52:47 GMT

Hello,

we have some drops, but changing MTU to 1500 slows the growing. They don't seem to correlate to the policy installs.

Regards,

Jan

Re: UDP packet loss after installing policy R81.20

Jan_Kleinhans — Mon, 16 Dec 2024 08:53:22 GMT

Hello,

we have "Keep all connections" enabled.

Regards,

Jan

Re: UDP packet loss after installing policy R81.20

Timothy_Hall — Mon, 16 Dec 2024 13:08:00 GMT

According to sk111407:

In the SecureXL UPPAK mode:

The maximum MTU is 9000 bytes.
When you configure the MTU of more than 1500 bytes for the first time on any interface, you must reboot the Security Gateway

Also when UPPAK mode is enabled, the maximum MTU for slowpath traffic is 2002:

sk181250: HCP report shows "Jumbo Frame Error" when SecureXL works in the User Space (UPPAK) mode

I'd avoid using jumbo frames on 9000/19000/29000 until these issues are ironed out.

Re: UDP packet loss after installing policy R81.20

Jan_Kleinhans — Mon, 16 Dec 2024 13:34:20 GMT

Thanks for your Investgation. We were using MTU of 1600. As we don't need them at the moment we could revert to 1500. Before this we had millions of RX-DRPs.

Regards,

Jan

Re: UDP packet loss after installing policy R81.20

Chris_Atkinson — Mon, 06 Jan 2025 05:33:00 GMT

sk182740 is the only thing I've stumbled across, but seems it shouldn't be relevant if the problem persists on Take 89?

sk182730 is fixed in take 96 but perhaps not entirely your issue either.

Re: UDP packet loss after installing policy R81.20

Jan_Kleinhans — Wed, 08 Jan 2025 09:06:58 GMT

TAC can replicate the issue now. At the moment it seems that the problem only happens when using UPPAK. RnD will do further investigation.

Re: UDP packet loss after installing policy R81.20

Jan_Kleinhans — Tue, 02 Dec 2025 09:11:23 GMT

Problem has been solved with T120

PRJ-63470,

PMTR-118999