Hi,
I'm in the process of migrating an ASA Cluster to R80. Everything is fine but one thing. In the deployment there are certain dual-homed machines that do not route packets properly back through the firewall and packets would be dropped by the new Check Point installation with "packet out of state". These machines cannot be "fixed".
On the ASA you can create a service policy to ignore such traffic with src/dst selectors for tcp traffic. On the Check Point all I know is that there is a switch to essentially turn off state inspection completely, which I obviously don't want to do.
So my question is, can I somehow allow traffic between a pair of hosts/network, if the packets are "out of state" but at the same time still enforce the default packet state inspection?
Thank you
Christoph
