Connection terminated before the Security Gateway was able to make a decision

[Gacki]

Hello,

I have a problem that the idream.pl website works properly inside the company, but if there is a VPN access to the website, unfortunately a too long wait message pops up, the checkpoint logs show what is in the connector. 

A rule is made that should allow access to this page.

[Chris_Atkinson]

Have you already reviewed sk113479?

[Gacki]

yes, but i didn't find the answer there.

my error is 

Connection terminated before detection: Insufficient data. <X> bytes passed

Data packets have arrived, but the amount of data was not enough for the engine detection. The string will also state the number of data bytes (TCP/UDP payload) that may pass the Gateway.

now the question is how can i solve it?

[the_rock]

I had this happen with customer before and TAC told us that sk simply states its not CP issue, to make a long story short : - ). I actually agree with that, because logically, connection gets terminated, but there is proof anywhere its the fw causing it.

You definitely need to run some captures and confirm whats happening with the traffic.

Andy

[Gacki]

Can you suggest how best to capture this traffic? additionally wireshark? or on the checkpoint side?

[the_rock]

Lets do remote if you are allowed and I can help you. If not, please provide the source/dst IP addresses with ports/protocol involved and I can send you the captures you need.

Cheers mate.

Andy

[Gacki]

we are trying to connect to idream.pl (137.74.1.35) http (TCP/80)

[the_rock]

K, cool. Can you please give me one source IP you are testing from, so I can give you right capture flags?

Cheers,

Andy

[Gacki]

10.10.12.16

[the_rock]

fw monitor -e "accept host(137.74.1.35);"
fw monitor -e "accept host(137.74.1.35) and port(80);"
fw monitor -e "accept host(137.74.1.35) and host(10.10.12.16);"
tcpdump -nni any host 137.74.1.35
fw monitor -F "10.10.12.16,0,137.74.1.35,80,0"
fw monitor -F "10.10.12.16,0,137.74.1.35,80,0" -F "137.74.1.35,0,10.10.12.16,80,0"

Just as a side note, though you already probably know this, tcpdump will NOT show you any inspection points taking place, simply if traffic is hitting any interface on the firewall, but fw monitor would show you those things.

Andy

[Gacki]

i.e. it's not a checkpoint problem, but something before the checkpoint is causing not all data packets to arrive

[the_rock]

Correct and that sk is literally LONG way of simply saying "This is not Check Point issue" 🙂