topic Re: DF bit in General Topics

DF bit

knassif — Mon, 03 Jun 2024 18:42:10 GMT

is there any way or command on checkpoint firewall gateway to ignore the DF bit flag and assemble traffic as normal.

thanks

Re: DF bit

knassif — Mon, 03 Jun 2024 18:57:32 GMT

and this is for regular traffic not for vpn traffic is there a way to ignore that DF bit flag on the firewall with a command ?

Re: DF bit

the_rock — Mon, 03 Jun 2024 19:26:14 GMT

Not sure about regular traffic, but this is best I can find.

Andy

https://support.checkpoint.com/results/sk/sk39270

Re: DF bit

PhoneBoy — Mon, 03 Jun 2024 20:07:20 GMT

This SK is mostly relevant for VPN.
In Linux, at least according to here, the way you would do this would be something like:

ip route add 192.168.1.0/24 dev eth0 mtu lock 1500

You can try this in expert mode and see if it works.
Replace 192.168.1.0/24 with the subnet that requires DF be cleared.
However, I cannot say if this command will work on Gaia or not.
Even if it does, it probably won't persist across reboots or even certain configuration changes in clish/WebUI.

Re: DF bit

the_rock — Tue, 04 Jun 2024 00:27:58 GMT

You got it, thats it

from my lab:

[Expert@CP-gw:0]# ip route add 192.50.50.0/24 dev eth1 mtu lock 1500
[Expert@CP-gw:0]#

Best,

Andy

Re: DF bit

knassif — Tue, 04 Jun 2024 15:37:47 GMT

is there anything can be done to fix a fragment drop? as you can see in screenshot below/attached

Re: DF bit

knassif — Tue, 04 Jun 2024 15:55:54 GMT

also can you explain to me what that output means and if there is a way to fix it on the firewall

Re: DF bit

knassif — Tue, 04 Jun 2024 16:06:15 GMT

we use VSX so not sure how we can add the lock for a route, as far as I know we shouldnt add routes from cli for VSX and I dont see that as an option in Smartconsole

Re: DF bit

the_rock — Tue, 04 Jun 2024 17:25:40 GMT

To fix a drop? Not sure, maybe worth TAC case.

Andy

Re: DF bit

PhoneBoy — Wed, 05 Jun 2024 23:02:41 GMT

If it's not an option from SmartConsole (where you have to define routes for a VS with VSX), then it's probably not supported.
A few TAC cases I reviewed suggest this isn't supported as well, but best to check with them to confirm: https://help.checkpoint.com