rad - connections to cws.checkpoint.com stay in close_wait for 180min

Luis_Miguel_Mig — Sun, 21 Mar 2021 16:52:44 GMT

R80.40 take 94

I have noticed in the smartconsole logs that about 10 connections per hour sourced from the gateway to cws.checkpoint.com get dropped by the firewall itself saying that "first pack isn't syn" tcp flags FIN-ACK.

After digging a bit I noticed that the gateway receives the FIN, sends the FIN-ACK but it only sends the FIN 3 hours later by then the tcp entry is not in the tcp sessions table and therefore the gateway drops the connection.

With netstat I can see that those connections are likely opened with the rad process

[Expert@fw1:0]# netstat -apn
tcp 1 0 1.1.1.1:55962 1.1.1.2:80 CLOSE_WAIT 13470/rad
tcp 1 0 1.1.1.1:55736 1.1.1.2:80 CLOSE_WAIT 13470/rad
tcp 1 0 1.1.1.1:55734 1.1.1.2:80 CLOSE_WAIT 13470/rad
tcp 1 0 1.1.1.1:55700 1.1.1.2:80 CLOSE_WAIT 13470/rad
tcp 1 0 1.1.1.1:55960 1.1.1.2:80 CLOSE_WAIT 13470/rad
tcp 1 0 1.1.1.1:55862 1.1.1.2:80 CLOSE_WAIT 13470/rad
tcp 1 0 1.1.1.1:55928 1.1.1.2:80 CLOSE_WAIT 13470/rad
tcp 1 0 1.1.1.1:55896 1.1.1.2:80 CLOSE_WAIT 13470/rad

I wonder why the gateways delays the closure for 3 hours

Re: rad - connections to cws.checkpoint.com stay in close_wait for 180min

PhoneBoy — Sun, 21 Mar 2021 21:51:38 GMT

That sounds worthy of a TAC case.

topic Re: rad - connections to cws.checkpoint.com stay in close_wait for 180min in General Topics

rad - connections to cws.checkpoint.com stay in close_wait for 180min

Re: rad - connections to cws.checkpoint.com stay in close_wait for 180min