Traffic Dropped - Reason: fwmultik_f2p_cookie_outbound_and_routing failed

[sx8n20394]

I have a TAC case open for this but I wanted to know if anyone else is experiencing this on R82.00.05 (998000913). 

This is our first time deploying a 2500 series Quantum Spark. We put in a new firewall for a client and are getting traffic dropped like crazy with the following error:

dropped by fwmultik_process_f2p_packet_inner Reason: fwmultik_f2p_cookie_outbound_and_routing failed.

We enabled PMTUD and even tried to Allow Accept out of state TCP packets with no luck. We eventually turned off SecureXL and the traffic stopped dropping. I then turned SecureXL back on and then cleared all of the connections via: "fw tab -t connections -x -y". Traffic stated steady for about an hour and then started dropping again. Support said they would send it to the escalation team but I wanted to know if anyone else has run into this. 

[Alex-]

You might want to consider R82.00.10 if you can.

We let it run in staging mode for a while before going into production and no issues to report on 1535.

A customer is running a 2500 and didn't report issues either. However, if you have TAC engaged, they will provide the relevant steps.

[sx8n20394]

The TAC got back to me and told me the escalation team recommended R82.00.10 Build 998001562. The TAC support person said there is nothing in the release notes about fixing SecureXL issues but it was still recommended to upgrade. This client is one of our biggest and most delicate (lots of on-prem business critical applications) so we are going to wait until we get someone onsite to do the firmware upgrade just incase it becomes unresponsive, etc.

[the_rock]

Definitely wise idea.

[sx8n20394]

Do you know if anyone has reported any issues with R82.00.10 Build 998001562 or issues updating? I have upgraded quite a few Checkpoints in the past 10 years (r77, r81) and never actually had an issue. This is more of a management decision in regards to waiting for someone to go onsite.

[the_rock]

Personally, I dont know of anyone having an issue updating to it. 

[Vincent_Bacher]

If it is a political decision that someone should be on site to provide support when needed, then it is pointless to argue against it with technical arguments, unless you have out-of-band management. Political decisions always take precedence.

[sigal]

Hi, 
Can you please share more details about your topology? Which traffic is dropped? Which Software Blades are enabled?

Thanks.

[sx8n20394]

Traffic is almost all completely random. Most of the traffic dropping is 443 but there are others port 4001,2001, etc that are for different applications.

One specific situation is that people on the remote access VPN cannot access an internal site until they ping the site first. After that they can access it.

The network is just one flat network, nothing fancy.

All blades enabled.

[sx8n20394]

Unfortunately, upgrading firmware didn't help. Still the same traffic dropping with:

wmultik_process_f2p_packet_inner Reason: fwmultik_f2p_cookie_outbound_and_routing failed;

[the_rock]

I would let TAC know, as you already have the case opened. At this point, sounds like there might be need for some further debugs...just my educated guess.