R81.20 JHF41 TCP Handshake counter fills up

[Mikael]

Hello,

Has anyone else seen this issue where the TCP Handshake and connections counter seems to fill up the 64-bit counter?

We have seen this on multiple customers, all running R81.20 JHF41 and it seems to affect both regular clusters as well as VSX VS's.

I found this while troubleshooting an issue where the customer reported traffic drops while pushing policy...

Cheers

[the_rock]

I believe its known problem. I also seen it myself and mentioned to TAC on an unrelated case and guy said they were aware. I never opened an official case, but never asked who is aware and who is working on a fix. He seemed to suggest its more of a cosmetic issue, but I sadly have no proof of that.

Best,

Andy

[Mikael]

Ok, good to know that I'm not alone 😀

I will open a case to have an official reference.

Cheers

[the_rock]

I agree, better get an official answer.

Best,

Andy

[CheckPointerXL]

maybe PRHF-31092 ?  ( traffic drops while pushing policy)

available only on custom hotfix

[the_rock]

I think that is related to your post from end of November 2023. I dont see that PRHF  listed in fixed IDs...either take 41 or 45, the latest one.

Andy

https://community.checkpoint.com/t5/General-Topics/R81-20-T26-Traffic-disruption-during-policy-insta...

[AkosBakos]

HI Mikael,

We found your article today. Let's say, same here. (we have MAESTRO)

Do we know the exact solution? We got a hotfix from TAC (fw1_wrapper_HOTFIX_R81_20_JHF_T41_844_MAIN_GA_FULL.tar) and we will install it tonight.

Does it solve the policy install problem?

Br

Akos

[Mikael]

Not sure about the policy install issue. In our case it seems to have been solved by changing the settings to “keep all connections”. This issue with the counter filling up is still under investigation by TAC. 

[AkosBakos]

Hi, we set the “keep all connections”, but this didn't solve the issue. A lot of clusters have the "rematch connections" by our customers, and they didn't report any issue. 

Please post if the TAC gives a good solution. I am curious 🙂

A

[Jan_Kleinhans]

Hi,

do you have any solution? Do you see any log entries when traffic is dropped?

Jan

[AkosBakos]

Hi Jan,

We received a custom hotfix, for the original issue (during policy installation the connentions are dropped).

After the installation everything works as expected.

Cheers

Akos

[Julian_Wagner]

We are experiencing the same issue. 
Did someone got an official answer from Check Point, or at least know if it was resolved in R81.20 Take 70?

[AkosBakos]

Hi @Julian_Wagner 

It has already fixed in take 54:

PRJ-50761, PRHF-31092

Security Gateway

On Security Gateways with enabled Hyper Flow feature, during policy installation and re-offload process of the connections, accelerated connections may be interrupted. Refer to sk181671.

Cheers

Akos

[Bob_Zimmerman]

I just saw this on some R81.20 jumbo 76 systems. The reported value, 18,446,744,073,709,552,000, is actually a little higher than would fit in a 64-bit counter. It's 2^64 + 2^8 + 2^7. Definitely some kind of bug.

[David_Evans]

Has anyone gotten a solution to the handshake counter specifically?

   Its been on and off again across our infrastructure on R81.10 and R81.20 on Maestro and non Maestro firewalls.     It actually seems to be getting worse and not better up through Jumbo 105.