Hi all,
It's an AI R55,IPSO 3.7 B32 environment, consecutive UDP packets sent to FW and will
be Nated by FW ,then go through the FW.
We found sometimes UDP packets lost due to unknown reason, I am seeking any help here.
1 Inbound interface log by TCPDUMP
No. Time Source Destination FW-1 if Protocol Info
1 0.000000 10.162.65.156 210.21.197.10 ^ UDP
Source port: 1104 Destination port: 3456
2 1.500755 10.162.65.156 210.21.197.10 ^ UDP
Source port: 1104 Destination port: 3456 <<<<<this packet was lost
2 strange thing found in fw_monitor,above 2nd UDP packet was wrongly Nated in the
inbound interface Eth-s1p3c0, thus was dropped later.
No. Time Source Destination FW-1 if Protocol Info
1 0.000000 10.162.65.156 210.21.197.10 i eth-s1p3c0
eth-s1p2c0 UDP Source port: 1104 Destination port: 3456
2 0.000296 10.162.65.156 210.21.197.10 eth-s1p3c0 I
eth-s1p2c0 UDP Source port: 1104 Destination port: 3456
3 0.000334 10.162.65.156 210.21.197.10 eth-s1p3c0
eth-s1p2c0 o UDP Source port: 1104 Destination port: 3456
4 0.000504 211.138.28.129 210.21.197.10 eth-s1p3c0 O
eth-s1p2c0 UDP Source port: 25608 Destination port: 3456
5 1.500760 211.138.28.129 210.21.197.10 i eth-s1p3c0
eth-s1p2c0 UDP Source port: 25608 Destination port: 3456 <<<< Why was
NATed!!!
6 1.500935 211.138.28.129 210.21.197.10 eth-s1p3c0 I
eth-s1p2c0 UDP Source port: 25608 Destination port: 3456
7 1.500960 211.138.28.129 210.21.197.10 eth-s1p3c0
eth-s1p2c0 o UDP Source port: 25608 Destination port: 3456 <<<< Dropped
The only difference for the 2 UDP packets was ip_identification=0x0b16 and 0x0b17.
Any experience for this issue? or any suggestion for further troubleshooting?
Your input will be great appreciated!!
Br,
LIn Murong
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
