Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
David_M_Almas
Contributor
Jump to solution

Quick log growing with "IP multicast routing failed"

Hi all!

 

We're using a cluster of 15400 appliances running R80.40 in VSX (VSLS mode).

Since a few days ago our older logs started being deleted because of log files increasing way faster than before.

We found that the culprit is a message from 2 new appliances recently installed in one of our VLANs. Those appliances are trying to reach a bunch of multicast addresses and the Check Point gateway fails to resolve the route:

 

@;1403431;[vs_2];[tid_6];[fw4_6];fw_log_drop_ex: Packet proto=17 10.80.202.51:2252 -> 224.2.2.1:2251 dropped by fw_log_ip_routing_failure Reason: IP multicast routing failed (too many packets received before route was resolved);

 

We tried configuring Multicast Restrictions under the interface configuration for those multicast addresses but no luck. Also sk170922 doesn't seem to apply. Tried adding a adbkern.conf file to $PPKDIR/conf/ with the line "adp_mc_rt_hold_queue_len=20" and rebooting the gateways: still no luck. Also disabled the "Enable drop optimization" in the corresponding VS with the same result. No luck also in configuring a simple rulebase to just silently drop all the requests from this appliances...

 

The vendor of the appliances are working on a solution but it will take some time (why?!?!?).

Is there any chance that we could disable the logging of this events/errors or somehow silently dropping them?

 

Any help is welcome! 🙂

0 Kudos
1 Solution

Accepted Solutions
David_M_Almas
Contributor

So we did and the workaround is to set "fw_log_missing_route_packet" to '0' to disable logging of this errors.

View solution in original post

0 Kudos
2 Replies
PhoneBoy
Admin
Admin

Recommend a TAC case.

David_M_Almas
Contributor

So we did and the workaround is to set "fw_log_missing_route_packet" to '0' to disable logging of this errors.

0 Kudos

Leaderboard

Epsum factorial non deposit quid pro quo hic escorol.

Upcoming Events

    CheckMates Events