topic Re: Loop prevention drops in Firewall and Security Management

Loop prevention drops

okatsladz454 — Wed, 10 Dec 2025 14:48:40 GMT

Good afternoon.

We are faced with the following problem - some of the packets going to certain Internet addresses are dropped at the kernel level with an error (find it in zdebug + drop):

resume_inbound_from_vm_reinject: dropping packet of for vsid=0 due to loop prevention (nloops=4, pkt_type VM Reinject, prev state Lookup, next state Lookup, in flags 0x4).

Gaia version: R82 take 44 Maestro (Any problems with distribution and asymmetric excluded)

There are two connections - intranet and extranet, both transmit routes via BGP.

The problem occurs only on a part of the connections and only to connections at certain white addresses. There are no problems with other connections that use the same access control policy rules and the same logic.

Questions:

1. What does loop prevention even mean? Does this apply to STP? Or to routing and loop protection in BGP? fwaccel stats -d showing huge amount of drops caused by Loop prevention

2. Any clues, how to fix this?

Re: Loop prevention drops

the_rock — Wed, 10 Dec 2025 18:10:15 GMT

I cant seem to open image you attached (this seems to be an issue with everyone lately, anything attached shows virus scan in progress...maybe @_Val_ or @PhoneBoy can comment on that part).

Now, as far as your issue...definitely STP can be related...is it enabled or not?

Re: Loop prevention drops

PhoneBoy — Wed, 10 Dec 2025 18:40:53 GMT

Will check on the virus scan issue.

Re: Loop prevention drops

the_rock — Wed, 10 Dec 2025 18:44:16 GMT

Not a huge issue, but I did notice it for everyone whose attachments I tried opening last few days...

Re: Loop prevention drops

PhoneBoy — Wed, 10 Dec 2025 19:08:26 GMT

Seems to be a known issue that is in the process of being addressed.

Re: Loop prevention drops

Chris_Atkinson — Thu, 11 Dec 2025 01:32:20 GMT

Are these drops for legitimate traffic flows or just something that you've observed?

How is the routing configured for the subnet in question on the Firewall and downstream device...

Re: Loop prevention drops

okatsladz454 — Thu, 11 Dec 2025 08:05:08 GMT

Good morning.

This directly affects the third party of VPN tunnels going through the firewall. Not all of them, just not a very large part, but we don't have an answer as to why these particular tunnels are affected and other are not.

Routing is set up very simply - down (to the LAN of the organization) via BGP, up (to the provider) also via BGP, but using a public ASN.

Re: Loop prevention drops

okatsladz454 — Thu, 11 Dec 2025 08:07:37 GMT

Thanks for the reply. I don't think STP has any effect - if it did, then loop protection would occur on all traffic, and not just on a very specific one. I need to understand specifically what loop prevention generally refers to.

Re: Loop prevention drops

the_rock — Thu, 11 Dec 2025 11:28:22 GMT

Is there any difference with those tunnels? route or domain based?

Re: Loop prevention drops

the_rock — Thu, 11 Dec 2025 11:29:00 GMT

Usually, should be enabled.

Re: Loop prevention drops

okatsladz454 — Thu, 11 Dec 2025 12:19:29 GMT

I see no diffrence.

They re all transit, check point just making a translation/

Re: Loop prevention drops

the_rock — Thu, 11 Dec 2025 12:21:01 GMT

Might be worth TAC case then to check further.

Re: Loop prevention drops

_Val_ — Thu, 11 Dec 2025 12:27:58 GMT

Please open a TAC request for this via https://help.checkpoint.com

Re: Loop prevention drops

the_rock — Tue, 16 Dec 2025 17:20:55 GMT

Hey mate,

Were you able to make any progress with this?

Re: Loop prevention drops

okatsladz454 — Mon, 22 Dec 2025 09:15:50 GMT

Good afternoon. The case in TAC was just started yet. We were waiting for the installation to be updated to the new JHF, but unfortunately it didn't help.

Re: Loop prevention drops

Gennady — Mon, 22 Dec 2025 11:31:53 GMT

Good day!

As a guess, I recommend to check output of "fwaccel ranges" command to find out if the problematic white IP-addresses are present in more than one range.

1. use "fwaccel ranges -l" to list all the ranges associated with interfaces.

2. use "fwaccel ranges -p" to see the list of networks as your SGM see it in Topology for an interface. It may be a very long list for your Internet facing interface.

The loop prevention seems to be related more to routing decision function performed in SecureXL before sending a packet out of an interface. The problem may occur in case if the same network/IP is present in more than one "anti-spoofing" range. Another way to check the same would be to analyze your routes carefully but it would not exclude any bug in topology calculation. "fwaccel ranges" from the other hand will show you exactly how routing is seen by SecureXL topology and may help to find the problem.

Re: Loop prevention drops

Claudio_Bolcato — Mon, 26 Jan 2026 12:37:39 GMT

Did you manage to fix the issue?
I'm experiencing the same problem and I've a TAC case open and they gave me an hotfix but the kernel debug is keep showing drops due to loop prevention. I'm running R82 take 44

Re: Loop prevention drops

TINTIN8 — Mon, 16 Mar 2026 23:37:52 GMT

We have the same issue. TAC instructed us to upgrade to Take 60. But now take 73 is out. But its not recommended yet. Looking at the timetable and how things have changed in the past, we should expect a new version coming up pretty soon, which will be the recommended version. It's such a pain for us, as the entire project now depends on this.


Version	Released Date	Became Recommended upgrade	No of days between release and becoming recommended
Take 33	08 July 2025	Recommended on 16 July 2025	8 days
Take 34	23 July 2025	Recommended on 27 July 2025	4 days
Take 36	31 July 2025	Never became recommended
Take 39	27 August 2025	07 September 2025	11 days
Take 41	03 September 2025	Never became recommended
Take 43	19 October 2025	Recommended on 29 October 2025	10 days
Take 44	05 November 2025	Recommended on 23 November 2025	18 days
Take 60	29 December 2025	Recommended on 19 January 2026	21 days
Take 73	17 February 2026

Re: Loop prevention drops

the_rock — Tue, 17 Mar 2026 00:06:54 GMT

Take 73 seems to be stable so far.

Re: Loop prevention drops

kamilazat — Tue, 17 Mar 2026 06:57:49 GMT

We opened a case and TAC provided us with a hotfix and then recommended setting the parameter fwmultik_dispatcher_in_tap_mode=1. Apparently this needs to be done 'after' installing the fix. Now the issue seems to be resolved. Also there seems to be a new sk about it:

https://support.checkpoint.com/results/sk/sk184805