You shouldn't do that. Stateful Inspection is an important aspect of your security. Check the cause of the problem. The first packet of any TCP connection HAS to be a SYN packet. If it's not (as seen by any checkpoint gateway), then you either have asymmetric routing or synchronization problems between cluster members or some other problem. Correct THAT problem.
-----Original Message----- From: Mailing list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED] On Behalf Of Alex Hayes Sent: domingo, 6 de Janeiro de 2008 07:05 To: [email protected] Subject: Re: [FW-1] Check Point Drop out of state TCP packet yes, my idea is to let pass the traffic necessary to continue working the application. Take off the contentions. ----- Original Message ---- From: sin <[EMAIL PROTECTED]> To: [email protected] Sent: Friday, January 4, 2008 7:59:02 PM Subject: Re: [FW-1] Check Point Drop out of state TCP packet Alex Hayes wrote: > I have severals messages of: > > TCP packet out of state: First packet isn't SYN; tcp_flags: RST > TCP packet out of state: First packet isn't SYN; tcp_flags: RST > TCP packet out of state: First packet isn't SYN; tcp_flags: RST > TCP packet out of state: First packet isn't SYN; tcp_flags: RST > TCP packet out of state: First packet isn't SYN; tcp_flags: ACK > TCP packet out of state: First packet isn't SYN; tcp_flags: RST > TCP packet out of state: First packet isn't SYN; tcp_flags: RST > TCP packet out of state: First packet isn't SYN; tcp_flags: RST > > Do you know why? maybe because a new tcp connection needs to have it's first packet with the SYN bit set and from what your logs say, the packets dropped don't have the SYN bit set. > > I read that I need to go to Policy ---Global Properties---- > Stateful Inspection and deselect the flag "Drop out of state TCP packet" yup, it will keep your logs clean. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ________________________________________________________________________ ____________ Never miss a thing. Make Yahoo your home page. http://www.yahoo.com/r/hs ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ############################################################################################### Verificado por MailMarshal Marshal é uma solução de segurança de conteúdos, com capacidade de anti-virus, anti-spam, anti-phishing, anti-spyware, análise de imagems, DHA e DoS ao nível da gateway. Para obter mais informações e uma versão totalmente funcional com validade para 30 dias visite http://www.tecnidata.pt/Solucoes/Solucoes+Tecnologicas/SegurancaTI/Seguranca+de+Conteudos.htm Se pretender uma demo deste produto contacte em Portugal [EMAIL PROTECTED] ############################################################################################### ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
