first tcp syn packet is failed

[Chris_Atkinson]

Which versions/ JHF is the system in question?

Generally speaking this topic has been covered extensively here previously even including recent hotfixes / half-closed timer settings for similar

[G_W_Albrecht]

I would consult TAC as this is VSX  and First packet isn't syn rather sounds like a config error !

See sk117374:

It is possible to override the "Out of State" settings in the Global Properties on the Security Gateway by changing the values of the relevant kernel parameters on-the-fly.

The above procedure is only temporary and will not survive a reboot, restart of Check Point services (cpstop;cpstart, or cprestart), or policy installation.

While it is possible to make this setting permanent, this is strongly disapproved ! Why ? You will only cover an error in configuration that better is generally fixed, and sk117374 adds:

The implications of changing the TCP and ICMP out of state inspection settings should be fully understood before altering them.

[the_rock]

I agree with @G_W_Albrecht , probably better to consult with TAC as its VSX.

[PhoneBoy]

You're making a change in a way that is not persistent.
You can disable it for a specific VS (or gateway) using: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut...

As noted here, this is generally not recommended and has some security implications.
It's better to configure a specific exception (versus disabling this globally for the gateway) using this procedure: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solut... 

[umar7]

thanks for the responce guys

[G_W_Albrecht]

Did you contact TAC or how did you proceed after the discussion here ?

[umar7]

hello @G_W_Albrecht ,

i have created the checkpoint TAC case we are working on it.

[the_rock]

Hey @umar7 , just wondering, did you put the value in $FWDIR/boot/modules/fwkern.conf file and save, as that makes it permanent even after reboot.

https://sc1.checkpoint.com/documents/R81/WebAdminGuides/EN/CP_R81_CLI_ReferenceGuide/Topics-CLIG/Ker...

[G_W_Albrecht]

I hope he did not do that - the security implications would make this a solution for LAB only...

[the_rock]

I agree. The only reason I said that is because @umar7 mentioned the setting keeps reverting back, so change I mentioned would make it permanent. The issue should be fixed so packets out of state are indeed dropped, as they should be.