"UDP checksum is incorrect" - 100s of IPv6 DROPs in fw.log - TP/IPS responsible?

[Jerry]

hi folks

quick one

one of my customers just upgraded to R82 last night and found in fw.log 100s of drops due to "UDP checksum is incorrect".

knowing how UDP works I presume that TP/IPS is to blame but which protection is responsible for that? 

any clues?

[Jerry]

hi folks, just FYI.

SR#6-0004131671

wonder how long would it take to manage that "task" and proceed with the t-shooting and coding afterwards ...

I've been notified about that SR 3 weeks ago, since then I'm constantly asked by already 3rd L3 TAC: "hello Team, can you please clarify what troubleshooting steps have been already taken?" - when I answer, in about another 7 days another L3 is asking precisely same question.

seems we're all getting "festive" latelly ... fingers crossed it will end up good for our NIC's and its drivers soon.

happy hols to all !

[the_rock]

Hey brother,

Did you link this post in that SR? I always do that if there is similar or even my own post about the exact topic I open the ticket for.

Andy

[Jerry]

no, just let engineer know about that thread here. hope it helps, let's wait.

[the_rock]

If I were you, I would 100% send them the link, because they can read all the posts and what everyone has said about it so far.

Andy

[Jerry]

hey buddy, I did that 3 weeks ago so I bet that within the SR trial comments there is one with the URL to that thread. That's what I've mentioned by my previous post. Regardless of that I'm still waiting for ANY response. So far I've been having just emails asking about wht t-shooting steps have been already taken. How many times you reply to such updates ....

I know people are busy these times but hey, let's give 'em some space and time and see what they come up with. I bet that JHF may fix drivers issue with modular NICs as I do not believe I'm the only one having issues like reported here.

Cheers!

[the_rock]

I hear ya. But I mean, honestly, regardless of how busy someone is, I cant even count how many times I read things like that at midnight on my own time, takes 10-15 mins.

Anyway, as I always say, we cant control others, only ourselves. Lets hope with jumbo hotfix when it comes out, this gets solved.

Andy

[Timothy_Hall]

Presumably this is a NIC driver issue (due to the version update for R82) which is not directly Check Point's code; as such they will have to coordinate with the NIC vendor which I imagine is not a speedy process.

[Jerry]

That's what I thought Tim, indeed it may take some time but I just hope it isn't the one for decades 🙂 and JHF is on the production cycle alrady or if not - planned on the roadmap. You know that hope dies last ...

have a happy hols folks !

[nadmin]

I hate to necropost, but I'm seeing this issue in R82 JHF take 44 dropping my DNS traffic. Fresh lab build.

Rebooting the gateways fixed for now. Note that in VM environments like XEN we disable TX check summing on all firewall system interfaces.

But is definitely system shock going from R81.20 to R82.

[the_rock]

Thats why I always advise people to upgrade management for now and wait for the gateways.

[Timothy_Hall]

Dropping DNS traffic or just delaying it too much?  Does the behavior go away if you disable Anti-bot?  If so look at setting "dns=bg".  sk92224: Optimizing the categorization of DNS traffic by changing the Resource Classification Mode, ...

[nadmin]

Good question. In this this case straight up dropping and logging it as a drop due to checksum error.