Disabling "Drop out of state TCP packets" on a host by host basis. R81.10 HF87

[AaronPW]

Hello.  Due to an asymmetrical routing issue inherent in the design of our VOIP network I am trying to find out how I can disable this check for certain hosts or the entire VOIP network if necessary.   I see the option in Global Properties but I am trying to only disable this for some hosts that connect over an MPLS connection at each site. 

I know we need to redesign things so we don't have this issue but that is not an option at the moment. 

[AaronCP]

Hey,

Check out Vladimir's post in https://community.checkpoint.com/t5/Management/How-to-enable-TCP-out-of-state-exceptions-per-network...

[AaronPW]

I'm trying that but it just isn't having any effect.  I'm still seeing the drops. 

[AaronCP]

---

@AaronPW wrote:

I'm trying that but it just isn't having any effect.  I'm still seeing the drops. 

---

Have you tried modifying the INSPECT code as per https://support.checkpoint.com/results/sk/sk11088

[the_rock]

I think sk @AaronCP gave you is your best bet, but if that fails, I would maybe get an official TAC response. I know couple of years ago, they actually gave me Vladimir's post as well, but that sadly did not work, so customer simply ended up unchecking the global properties option. I know, its not the best workaround, but it seemed to be the easiest one at the time.

Andy

[AaronPW]

Apparently you cannot do this on a host by host basis in the way I am asking.  The L3 guy said I can only do this on an entire gateway basis and not on a network by network basis. But honestly the quality of help I get from CP TAC is hit or miss so I am going to try that other method with the file modification.

[the_rock]

Well, I guess an official response that only gateways there are supported. Its possible method Vladimir gave works, I never tested it myself.

Andy

[PhoneBoy]

By modifying the INSPECT code as described in sk11088, you can do exclusions on a per-host/network basis.