Hi! > I read that I need to go to Policy ---Global Properties---- > Stateful Inspection and deselect the flag "Drop out of state TCP packet"
>> yup, it will keep your logs clean. Well... I would consider this "solution" as a dangerous "out of sight - out of mind" solution that should be used only temporarily while finding out the root cause. Below I have gathered three cases I have seen causing the out-of-state error message in the log. The first case is asymmetric routing. Maybe a route is missing from a multi-homed server and only the reply packets go via your firewall and because the connection is not in the state table, you see the out-of-state-message in the log. Of course the route maybe incorrect anywhere on the route... The other typical case is that synchronization doesn't work correctly between cluster members. The connection is in the state table of the active cluster member, but when that one fails and connections transferred to the backup, the connection is dropped due to the out-of-state-error because it is missing from the state table of the backup cluster member. Third case when I have seen those errors is when the server replies very slowly and timeout occurs between syn- and ack-packets. In this case the firewall handles the packets as they belonged to different connections and drops the reply packets as out-of-state. br, -lari- -----Original Message----- From: Mailing list for discussion of Firewall-1 on behalf of Alex Hayes Sent: Sun 1/6/2008 9:05 AM To: [email protected] Subject: Re: [FW-1] Check Point Drop out of state TCP packet yes, my idea is to let pass the traffic necessary to continue working the application. Take off the contentions. ----- Original Message ---- From: sin <[EMAIL PROTECTED]> To: [email protected] Sent: Friday, January 4, 2008 7:59:02 PM Subject: Re: [FW-1] Check Point Drop out of state TCP packet Alex Hayes wrote: > I have severals messages of: > > TCP packet out of state: First packet isn't SYN; tcp_flags: RST > TCP packet out of state: First packet isn't SYN; tcp_flags: RST > TCP packet out of state: First packet isn't SYN; tcp_flags: RST > TCP packet out of state: First packet isn't SYN; tcp_flags: RST > TCP packet out of state: First packet isn't SYN; tcp_flags: ACK > TCP packet out of state: First packet isn't SYN; tcp_flags: RST > TCP packet out of state: First packet isn't SYN; tcp_flags: RST > TCP packet out of state: First packet isn't SYN; tcp_flags: RST > > Do you know why? maybe because a new tcp connection needs to have it's first packet with the SYN bit set and from what your logs say, the packets dropped don't have the SYN bit set. > > I read that I need to go to Policy ---Global Properties---- > Stateful Inspection and deselect the flag "Drop out of state TCP packet" yup, it will keep your logs clean. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ____________________________________________________________________________________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= Scanned by Check Point Total Security Gateway. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
