Mgmt traffice cannot cross bridge interface (double-inspection)

[Alvin]

Hello anyone,

I hope that the Mgmt interface update signature traffic can traverse the bridge interface of the same Security Gateway, I refer to SK105899, and add the following kernel data,

[Expert@R81:0]# cat $PPKDIR/boot/modules/simkern.conf
# Deprecated location.
# Any change should be made at /opt/CPppak-R81/conf/simkern.conf
sim_anti_spoofing_enabled=0
[Expert@R81:0]# cat $FWDIR/boot/modules/fwkern.conf
fw_local_interface_anti_spoofing=0
fw_antispoofing_enabled=0
fwx_bridge_reroute_enabled=1

At this point, I still cannot update, and I get the following message (fw ctl zdebug + drop)

@;3558;[cpu_1];[fw4_2];fw_log_drop_ex: Packet proto=6 172.16.13.192:43355 -> 96.7.254.216:443 dropped by fw_reroute_bridge_fold Reason: Bridge reroute, cksum is wrong;
@;3565;[cpu_1];[fw4_2];fw_log_drop_ex: Packet proto=6 172.16.13.192:43355 -> 96.7.254.216:443 dropped by fw_reroute_bridge_fold Reason: Bridge reroute, cksum is wrong;
@;3578;[cpu_1];[fw4_2];fw_log_drop_ex: Packet proto=6 172.16.13.192:43355 -> 96.7.254.216:443 dropped by fw_reroute_bridge_fold Reason: Bridge reroute, cksum is wrong;
@;3604;[cpu_1];[fw4_2];fw_log_drop_ex: Packet proto=6 172.16.13.192:43355 -> 96.7.254.216:443 dropped by fw_reroute_bridge_fold Reason: Bridge reroute, cksum is wrong;
@;3680;[cpu_2];[fw4_1];fw_log_drop_ex: Packet proto=6 172.16.13.192:26677 -> 96.7.254.216:443 dropped by fw_reroute_bridge_fold Reason: Bridge reroute, cksum is wrong;
@;3686;[cpu_2];[fw4_1];fw_log_drop_ex: Packet proto=6 172.16.13.192:26677 -> 96.7.254.216:443 dropped by fw_reroute_bridge_fold Reason: Bridge reroute, cksum is wrong;
@;3699;[cpu_2];[fw4_1];fw_log_drop_ex: Packet proto=6 172.16.13.192:26677 -> 96.7.254.216:443 dropped by fw_reroute_bridge_fold Reason: Bridge reroute, cksum is wrong;
@;3725;[cpu_2];[fw4_1];fw_log_drop_ex: Packet proto=6 172.16.13.192:26677 -> 96.7.254.216:443 dropped by fw_reroute_bridge_fold Reason: Bridge reroute, cksum is wrong;

I am currently running R81 GA version, and the problem also occurs in R80.40
Can anyone assist me in solving this problem?

[PhoneBoy]

Recommend a TAC case here.

[chinchira]

I am having a similar problem where am getting the same drop message. Please share how this was resolved.

Thanks.

[Chris_Atkinson]

Did you already try the solution from SK105899?

Double-inspection is otherwise not supported by SXL (sk172204) and you should review the topology/routing.

[chinchira]

We have done all the changes as advised by this SK105899. I suspect this kernel parameter 'fwx_bridge_reroute_enabled=1' could be the cause, but I stand to be guided. Maybe you can also expound more on what this parameter does. What would be gateway behavior if we remove this parameter?

Unfortunately topology change is not possible in the short-term, hence why we are looking for a solution on Checkpoint itself.

[AkosBakos]

Hi Chinchira,

I got the same error message. Do you have solution for this?

Thanks in advance,

Akos

[G_W_Albrecht]

I would recommend a TAC case here.

[AkosBakos]

Hi,

I hope this issue will be solved quickly. 🙂

Akos

[AkosBakos · Accepted solution]

It seems the issue have been solved:

We use only 2 out of the 4 kernerparameters (why should we use not relevant key-pairs??)

https://support.checkpoint.com/results/sk/sk105899

fw_local_interface_anti_spoofing=0

fw_antispoofing_enabled=0

fwx_bridge_reroute_enabled=1

fwx_perform_gateway_hide=0

Conclusion: all of the four key-pairs are needed