Checkpoint   Checkpoint – dropped Reason: UDP packet that belongs to an old session



Problem

Last week I came across a DHCP problem. Devices from certain VLAN were not getting DHCP assigned IP.

Even though firewall policy should have accepted those packets, tcpdump showed Checkpoint gateway was not forwarding them to the destination.

To capture DHCP traffic:

# tcpdump -n -i <interface> port 67 or port 68 -e

Incoming interface DHCP tcpdump:

# tcpdump 
Read more

Checkpoint   Checkpoint – Incrementing virtual system instances to solve cpu overload



Due to some network infrastructure changes, the traffic passing through my internal FW (a Checkpoint VSX virtual system) started to suffer latency and packet loss.

No change had been made to the Checkpoint VSX, but for any reason, since that network changes, Checkpoint was not processing the traffic succesfully.

Performing a top on the VSX appliance containing the active “iNTERNAL … Read more

Checkpoint   Checkpoint VSX: Force VS failover



There are several reasons to force a failover on a firewall cluster (in this case a virtual system on a 2 node Checkpoint VSX cluster). For example, testing, analyzing or maintenance purposes.

First of all, we can check the cluster and virtual systems states by executing the command on the VS0 (on Gaia clish or expert mode):

[Expert@vsx1:0]# cphaprob 
Read more