First Packet Isn't SYN drop

[DannyCor]

I am new to Checkpoint firewall and have been dealing with "First Packet Isn't SYN" issue for the last few weeks. This is happening between interface and one of application server, both server communicate on port 4000. The odd thing I see only first 3 packets are dropped then the 4th allowed to get through.

At the moment, I only have access to logs only, not configuration. Any configuration changes need to be communicated with other team.

Anything place I can start to troubleshoot the issue?

[the_rock]

That can sometimes be bit tricky to troubleshoot. I would say, run tcpdump and fw monitor to see whats happening with the traffic. Also, I would do ip r g command to make sure route is right. Say IP is 10.9.8.7, you can run ip r g 10.9.8.7 from the expert mode.

Hope that helps.

Andy

[AkosBakos]

Hi @DannyCor 

• If you check the name of the incoming interface at the first packet what do you see? (eg.: eth1)
• The interface is the same by that packet which is dropped?

Here is a screenshot what to check:

If not the same, we are facing with asymmetrical routing.

Akos

[the_rock]

Routing usually comes to mind with this sort of error.

[the_rock]

Also, some SKs to consider.

Andy

https://support.checkpoint.com/results/sk/sk107618

https://support.checkpoint.com/results/sk/sk31382

https://support.checkpoint.com/results/sk/sk180253

[Lesley]

First question is always, are these drops causing any issues? Are there issue reported of this connection flow or you just saw them?

And what is the issue? If they setup new connection is it slow? Or they get timeout after like 1 hour and have to rebuild connection.

[DannyCor]

In my case, it causes encoders not responding to PMS requests cutting room keys. 

[AkosBakos]

In this case please check the routing and the interface of the accepted and droppet packet. Itt might help