TCP out of state drop observed before the timeout configured in firewall

[praveshnayal]

Hello all,

We have encountered TCP out of state drops stating First Packet isn't SYN just after 10 mins of the connection initiation from the source. (After inactivity)

The timeout configured in the service port is default 3600 seconds so as per my understanding the connection entry should be there on the firewalls for 1 hour but in this case once the user returns to the application after 10 minutes the user gets disconnected and we can see out of state drop logs as mentioned above.

What could be the possible reasons for this behaviour? 

Thanks for any suggestions in advance.

[PhoneBoy]

Version/JHF of gateway involved?
What is the precise service in question?
Have you performed any tcpdumps to see what the application is doing during this time?

[Chris_Atkinson]

How is the memory utilisation of the appliance, any signs that aggressive aging has been activated?

[Cihat_Bulut]

If it is R81.10 JHF 66, then R&D is working on it. The fix will be soon.

[Tobias_Moritz]

Did you do a policy install between establishing the connection and "the user returns to the application after 10 minutes"?

If yes, then you can check sk103598 to see if you match a scenario from there.

[Cihat_Bulut]

From R&D;

We have a new workaround to be implemented on the GW:

Please run # fw ctl set int fw_tcp_enforce_half_closed_timeout 1

Install policy.

[Infrastructure3]

Hi Cihat,

Is there some SK article regarding this or logged as open bug somewhere to read more details of this condition?

[PhoneBoy]

A little more details here: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...