Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted
Ivory

R80.20 - Port reuse problem

Hi all,

This is my first post here. I had read a lot of posts before that helped me several times (thank you very much!) but it’s my first time writing something.

I’m facing a problem with one of our customers. He’s using a Bluecoat web proxy with persistent connections to connect to an Apache web server (Linux) on our side. There is a R80.20 gateway between us.

Sometimes, some of the connections become idle and so, our Apache is closing them once the Apache keepalive timeout is over.

When it happens, the Apache server sends a FIN packet that is acknowledged by the remote web proxy. However, the proxy is not sending back its FIN packet. Therefore, the TCP/IP stack of the web server operating system ends closing the socket.

The problem is that in that case, the connection remains in the gateway connections table until the session timeout is over (3600 seconds).

If there is a new connection meanwhile from the remote web proxy using the same source port, the gateway drops it with the following message seen in debug mode: “dropped by fw_handle_old_conn_recovery Reason: TCP packet that belongs to an old connection;”.

I thought that Smart Connection Reuse setting (which is enabled in our gateway) would avoid that kind of situations but maybe I haven’t really understood how it works.

Anyone else had a similar problem ?

 

Thank you very much for your help.


Regards.

0 Kudos
2 Replies
Highlighted
Admin
Admin

There is a kernel parameter that controls this behaviour. Look into https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

0 Kudos
Highlighted
Ivory

Hi @_Val_ 

Thank you for your answer.

This parameter was already enabled in our gateway (fwconn_smart_conn_reuse = 1) but it's not working as I would expect unless I'm misunderstanding this setting.

 

Is there maybe another parameter that could be overriding that one ?

0 Kudos