topic Re: dropped by misp_rt_chain ? in Firewall and Security Management

dropped by misp_rt_chain ?

amdhim0004 — Sat, 08 Aug 2020 04:32:30 GMT

Hello All,

Can you please help me to understand the below debug.

[cpu_1];[fw4_0];fw_log_drop_ex: Packet proto=47 65.**.**.123:0 -> 165.**.**.12:2048 dropped by misp_rt_chain Reason: Interface is inactive;
;[cpu_1];[fw4_0];fw_log_drop_ex: Packet proto=47 65.**.**.123:0 -> 165.**.**.12:2048 dropped by misp_rt_chain Reason: Interface is inactive;

Not sure what dropped by misp_rt_chain means.

Re: dropped by misp_rt_chain ?

Timothy_Hall — Sat, 08 Aug 2020 12:34:16 GMT

"Multiple ISP" aka ISP Redundancy. I'm guessing "rt" stands for routing, as in the packet can't be routed to one of your ISPs as the interface associated with that ISP is not working or defined incorrectly.

Re: dropped by misp_rt_chain ?

amdhim0004 — Sat, 08 Aug 2020 20:40:28 GMT

Thanks @Timothy_Hall

Yes, that's right we have 2 ISPs on that device.

Also, Primary ISP was down during the logs.

But why this traffic is still trying to go out via primary ISP when it was down?

Is anything related to old connections, Any suggestion?

Re: dropped by misp_rt_chain ?

PhoneBoy — Sun, 09 Aug 2020 04:26:32 GMT

Most likely it's an old connection.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk138872

Re: dropped by misp_rt_chain ?

amdhim0004 — Sun, 09 Aug 2020 04:46:13 GMT

Hi @PhoneBoy

Thanks for your response. Understood old connection should be trimmed out or should be reinitiated.

Do we have any option to change the connection timer based on a protocol to a specific gateway?

(We can do the same from CMA global properties but that will be global. is there any option to do the same on gateway level)

Re: dropped by misp_rt_chain ?

PhoneBoy — Sun, 09 Aug 2020 05:17:15 GMT

You can set it on a per service basis or per management domain, not per gateway.