UDP packet loss after installing policy R81.20

[Jan_Kleinhans]

Hello everybody,

is somebody experiencing packet loss in udp streams when installing policy. 

We have this issue with MS Teams and also with voip traffic. 

When you are in a voip call and install policy, right after the policy installation is finished the voip call begins to loose packets so that you cannot hear each other anymore or only some words. 

We are using R81.20 JHF 76 or 89 and have this issue on 2 VSX Clusters (Checkpoint 19200 using UPPAK) . We have a case open for this issue since over a  month now. The debugging scenario didn't work as it is to heavy for the firewalls and we experience more outages.

Maybe somebody is experiencing the same ?

Jan

[Chris_Atkinson]

For context how is your connection persistence currently set, any dynobjs used?

Are you still suffering Errors / Drops / Mbuf / Misses in your "show interface eth1-0X stats" output, if you chart those how do they correlate to the policy installs?

[Jan_Kleinhans]

Hello,

we have some drops, but changing MTU to 1500 slows the growing. They don't seem to correlate to the policy installs. 

Regards,

Jan

[Chris_Atkinson]

sk182740 is the only thing I've stumbled across, but seems it shouldn't be relevant if the problem persists on Take 89?

sk182730 is fixed in take 96 but perhaps not entirely your issue either.

[the_rock]

Hey Jan,

I read what @Chris_Atkinson responded with and exact same thought came to my mind. I had seen this before and it definitely could be related to setting below. I would set it to keep all connections.

Andy

 

• Keep all connections keeps all control and data connections open until the connections have ended. The newly installed policy will be enforced only for new connections.
• Keep Data Connections keeps all data connections open until the connections have ended. Control connections that are not allowed under the new policy will be terminated.

Rematch Connections means that all connections not allowed under the new policy will be terminated, unless the service has Keep connections open after policy has been installed is enabled in the Service Properties window.

[Jan_Kleinhans]

Hello,

we have "Keep all connections" enabled.

Regards,

Jan

[Timothy_Hall]

This thread sounds like it may be relevant to your issue:

https://community.checkpoint.com/t5/Security-Gateways/Message-seen-on-var-log-messages-quot-simi-reo...

[Timothy_Hall]

According to sk111407:

In the SecureXL UPPAK mode:

• The maximum MTU is 9000 bytes.
• When you configure the MTU of more than 1500 bytes for the first time on any interface, you must reboot the Security Gateway

Also when UPPAK mode is enabled, the maximum MTU for slowpath traffic is 2002:

sk181250: HCP report shows "Jumbo Frame Error" when SecureXL works in the User Space (UPPAK) mode

I'd avoid using jumbo frames on 9000/19000/29000 until these issues are ironed out.

[Jan_Kleinhans]

Thanks for your Investgation. We were using MTU of 1600. As we don't need them at the moment we could revert to 1500. Before this we had millions of RX-DRPs. 

Regards,

Jan

[Jan_Kleinhans]

TAC can replicate the issue now. At the moment it seems that the problem only happens when using UPPAK. RnD will do further investigation.

[Jan_Kleinhans · Accepted solution]

Problem has been solved with T120

PRJ-63470,

PMTR-118999