topic Re: When does CPEarlyDrop occur with ACCPET action ? in General Topics

When does CPEarlyDrop occur with ACCPET action ?

Gongya_Yu — Tue, 04 Jun 2024 04:12:03 GMT

When does CPEarlyDrop occur with ACCPET action ?

thanks !!

Re: When does CPEarlyDrop occur with ACCPET action ?

emmap — Tue, 04 Jun 2024 06:22:20 GMT

I'm not aware of any situation that we should 'early accept' a connection - are you seeing accept logs that mention CPEarlyDrop?

Re: When does CPEarlyDrop occur with ACCPET action ?

Gongya_Yu — Tue, 04 Jun 2024 13:30:52 GMT

See the following:
I might misinterpret it. but it is similar to CPEarly something, right ?

Re: When does CPEarlyDrop occur with ACCPET action ?

Gongya_Yu — Tue, 04 Jun 2024 14:09:59 GMT

Does this log say the traffic passing or not passing ?

Re: When does CPEarlyDrop occur with ACCPET action ?

the_rock — Tue, 04 Jun 2024 14:38:30 GMT

All that tells you in short is that its not really Check Point issue, its being allowed, but for some reason not fully completed.

Re: When does CPEarlyDrop occur with ACCPET action ?

Bob_Zimmerman — Tue, 04 Jun 2024 15:10:07 GMT

This message means the firewall isn't the problem. It allowed the SYN, but the connection was closed for some other reason before the firewall could see the website or application being attempted.

This is almost always because the server didn't respond with a SYN-ACK.

Re: When does CPEarlyDrop occur with ACCPET action ?

the_rock — Tue, 04 Jun 2024 15:11:07 GMT

What @Bob_Zimmerman said is PERFECT explanation, 100% the case.

Andy

Re: When does CPEarlyDrop occur with ACCPET action ?

Bob_Zimmerman — Tue, 04 Jun 2024 20:58:09 GMT

I did just think of a few ways the firewall could be to blame.

If this connection depends on NAT (e.g, an internal client with a private address connecting out to a public website) and the firewall is not configured to NAT the traffic, that would manifest as drops like this. The SYN is allowed and sent out with a private source, which the telco's routers drop, so the SYN-ACK never gets back to the firewall.
If the destination route is misconfigured leading to a routing loop between two other devices, the traffic would be lost, leading to no SYN-ACK from the server. I say a routing loop between other devices because if the firewall were involved in a routing loop, it produces a distinctive accept, drop, accept, drop pattern in the logs.

And at least one other way these messages may not indicate a problem at all:

If the source is doing some kind of health check (e.g, a load balancer or a monitoring server checking the status of a service), that might only open a TCP connection then close it immediately. This typically isn't a good health check, but it's very common. Such a connection won't contain enough information for the firewall to determine what website or application is in use, so you will get this message.

Re: When does CPEarlyDrop occur with ACCPET action ?

the_rock — Tue, 04 Jun 2024 23:58:44 GMT

All valid points, for sure.

Re: When does CPEarlyDrop occur with ACCPET action ?

Gongya_Yu — Wed, 05 Jun 2024 13:24:32 GMT

thanks to all !!