Dynamic objects from ACI not working

katarina_ — Mon, 29 Sep 2025 11:21:50 GMT

Hello Community,

we have an issue with dynamic objects imported from ACI and used in Access Control policy.

When we use static network objects, the traffic works fine. But when we replace it with dyn obj (imported form ACI) for the same subnet, the traffic does not match the rule and gets dropped by cleanup.

Environment:

Check Point is synced with Identity Awareness on the gateway
Check Point does not show any error in logs regarding the dynamic object
In SmartConsole, the dynamic object shows the correct hosts inside
with fw ctl zdebug + drop, we see traffic dropped by cleanup rule when the dynamic object is used as destination.

Tech Specs:

Hyperscale Maestro Solution 9700 running VS
Product version Check Point Gaia R81.20
HOTFIX_R81_20_JUMBO_HF_MAIN Take: 113

Is this known limitation or bug when using ACI dyn objects?

Are there any recommendations for debugging this further, or a known fix/workaround other then replacing with a static subnet?

Thanks in advance!

Re: Dynamic objects from ACI not working

Chris_Atkinson — Mon, 29 Sep 2025 14:56:05 GMT

Are the drops seen in debugs definitely for active machines?

Anything of interest in: cloud_proxy.elg

What do you see with "pep show user query cid a.b.c.d"

topic Re: Dynamic objects from ACI not working in Hyperscale Firewall (Maestro)

Dynamic objects from ACI not working

Re: Dynamic objects from ACI not working