topic Re: TCP packet out of state: First packet isn't SYN; tcp_flags: SYN-ACK" log in SmartView Tracker in General Topics

TCP packet out of state: First packet isn't SYN; tcp_flags: SYN-ACK" log in SmartView Tracker

Ramawatar_Maury — Fri, 06 Jul 2018 17:54:04 GMT

I have 5600 appliance running on Gaia R77.30 that is behind Sophos IPS and Sophos IPS is in bridge mode.

I am installing all latest hot fix but issue is still same some website is not accessible and in SmartView tracker that is showing TCP packet out of state: First packet isn't SYN; tcp_flags: SYN-ACK" .@

Re: TCP packet out of state: First packet isn't SYN; tcp_flags: SYN-ACK" log in SmartView Tracker

Houssameddine_1 — Fri, 06 Jul 2018 20:51:13 GMT

You might need to start by traffic captures and check the traffic flow after that you might start looking at timers for tcp connection.

Re: TCP packet out of state: First packet isn't SYN; tcp_flags: SYN-ACK" log in SmartView Tracker

Timothy_Hall — Fri, 06 Jul 2018 21:29:59 GMT

Please see my response in the thread below for guidance about how to troubleshoot this message:

https://community.checkpoint.com/message/9300-re-first-packet-isnt-sync?commentID=9300#comment-9300

--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com

Re: TCP packet out of state: First packet isn't SYN; tcp_flags: SYN-ACK" log in SmartView Tracker

Ramawatar_Maury — Sat, 07 Jul 2018 06:46:58 GMT

Dear Timothy

Thanks for your response i am trying all these step but issue is still same i am also trying to remove Sophos FW and terminate cable directly on Checkpoint 5600 appliance unmark URL filtering blade create one policy that is source LAN destination any services any allow with log enable.

Re: TCP packet out of state: First packet isn't SYN; tcp_flags: SYN-ACK" log in SmartView Tracker

Timothy_Hall — Sun, 08 Jul 2018 14:03:36 GMT

If I'm understanding your reply correctly, you are removing a Sophos firewall and trying to replace it with a Check Point. The instant the Check Point is connected you will get a flurry of "out of state" messages, since all the existing connections at the time of replacement are not known to the Check Point, and by default will be dropped.

You can blunt the impact of this replacement by unchecking "Drop out of state TCP packets" under Global Properties...Stateful Inspection and reinstalling policy to the firewall prior to the cutover. Unchecking this box will cause the firewall to attempt to "resurrect" the existing connections back into the state table and allow them to continue. You can also switch off the dropping of out of state TCP packets "on the fly" by running this command on the gateway: fw ctl set int fw_allow_out_of_state_tcp 1

Do not forget to recheck the "Drop out of state TCP packets" checkbox once the firewall replacement is complete and you have successfully executed your test plan. This setting should not be left disabled!

--
Second Edition of my "Max Power" Firewall Book
Now Available at http://www.maxpowerfirewalls.com

Re: TCP packet out of state: First packet isn't SYN; tcp_flags: SYN-ACK" log in SmartView Tracker

Ramawatar_Maury — Mon, 09 Jul 2018 06:22:12 GMT

Dear Timothy

Thanks for your response its work for me.