R80.20 - Port reuse problem

itcs — Tue, 28 Apr 2020 16:00:54 GMT

Hi all,

This is my first post here. I had read a lot of posts before that helped me several times (thank you very much!) but it’s my first time writing something.

I’m facing a problem with one of our customers. He’s using a Bluecoat web proxy with persistent connections to connect to an Apache web server (Linux) on our side. There is a R80.20 gateway between us.

Sometimes, some of the connections become idle and so, our Apache is closing them once the Apache keepalive timeout is over.

When it happens, the Apache server sends a FIN packet that is acknowledged by the remote web proxy. However, the proxy is not sending back its FIN packet. Therefore, the TCP/IP stack of the web server operating system ends closing the socket.

The problem is that in that case, the connection remains in the gateway connections table until the session timeout is over (3600 seconds).

If there is a new connection meanwhile from the remote web proxy using the same source port, the gateway drops it with the following message seen in debug mode: “dropped by fw_handle_old_conn_recovery Reason: TCP packet that belongs to an old connection;”.

I thought that Smart Connection Reuse setting (which is enabled in our gateway) would avoid that kind of situations but maybe I haven’t really understood how it works.

Anyone else had a similar problem ?

Thank you very much for your help.

Regards.

Re: R80.20 - Port reuse problem

_Val_ — Wed, 29 Apr 2020 07:49:30 GMT

There is a kernel parameter that controls this behaviour. Look into https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk24960

Re: R80.20 - Port reuse problem

itcs — Wed, 29 Apr 2020 08:00:00 GMT

Hi @_Val_

Thank you for your answer.

This parameter was already enabled in our gateway (fwconn_smart_conn_reuse = 1) but it's not working as I would expect unless I'm misunderstanding this setting.

Is there maybe another parameter that could be overriding that one ?

topic R80.20 - Port reuse problem in General Topics

R80.20 - Port reuse problem

Re: R80.20 - Port reuse problem

Re: R80.20 - Port reuse problem