This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
ABOUT CHECKMATES CYBER SECURITY COMMUNITY & FAQ
Help

Who rated this post

cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
HeikoAnkenbrand
MVP Platinum
MVP Platinum
‎2019-09-15 02:49 AM

If SmartView Tracker shows that ICMP packets are dropped with "message_info: ICMP reply does not match a previous request" log.
 
This drop is related to stateful inspection of ICMP. Due to a mismatch between the ID of ICMP Reply and the ID of the original recorded ICMP Request, Security Gateway will not find the original ICMP Request in the Connections table (id 8158) and will drop this ICMP Reply packet as out-of-state.
 
Try to find out why the replying device (or what forwarding device) is changing the ID in the ICMP Reply packet.
 

As an immediate solution or workaround, disable the Stateful Inspection for ICMP to allow this traffic:

  1. In SmartDashboard, go to the Policy menu - click on the Global Properties....

  2. In the left tree, click on the Stateful Inspection.

  3. Clear the box "Drop out of state ICMP packets" - click on OK

  4. Install Policy

Note: Disabling the Stateful Inspection will lower the security. This should be done with caution and only as the last resort.

➜ CCSM Elite, CCME, CCTE ➜ www.checkpoint.tips

View solution in original post

(1)
Who rated this post