Hi, we see on a checkpoint 5900 R80.10 cluster when Mac and Linux clients are going to certain websites that those websites load very slow or not at all. In tcpdump traces we see a lot of retransmission and dup ack's stalling the TCP session. In Windows we do not see this behaviour at all. We finally found this to happen when on the client this is set: net.ipv4.tcp_timestamps=1. In Linux you can disable this and then we do not see this issue but on Mac since El Capitan you can not disable this anymore. When you change this setting on a Windows client by netsh int tcp set global timestamps=enabled than you have the same behaviour. When using a proxy server for Mac clients with the tcp timestamps setting disabled also this problem disappears.
When the Mac and Linux clients are connected to a 1490 SMB this behaviour does not appear, so it is the combination client, Mac & Linux with net.ipv4.tcp_timestamps=1 set and our Checkpoint 5900 with R80.10 (although we also saw this on a 12210 with R77.x in 2016 when Mac went to Yosemite. We could only replicate it then when the Checkpoint had a high load and this behaviour disappeared after some tweaking with the multiple processors and added more memory.)
On the gateway policy we disabled all IPS, TCP Inspection settings but problem persists. Anybody else aware of some setting so the checkpoint works good with clients with tcp timestamps enabled ?
kind regards,
Mikel Aanstoot
