> Source: [sk1000026](https://support.checkpoint.com/results/sk/sk1000026)

# sk1000026 - Long-duration connection entry time out after policy installation on Cluster Load Sharing

| Property | Value |
|----------|-------|
| Solution ID | sk1000026 |
| Date Created | 2026-08-24 |
| Last Modified | 2026-10-04 |
| Technical Level | General |
| Products | Security Gateway, Cloud Firewall |
| Versions | R82.10, R82, R81.20, R82.20 |
| OS | Gaia |

## Symptoms

- * Connection older than 4 hours time out after policy installation on Cluster Load Sharing (Unicast) with multiple members
* At least one cluster member contains more than 10 active SecureXL-accelerated connections. Verify this with the command below on the Security Gateway:

      fwaccel conns

An administrator modifies a Security Policy rule. Examples:

* Add a host to the source.
* Remove an object from the destination.
* Change the logging settings.

After a successful Policy installation:

* ClusterXL duplicates the affected connection entries on another cluster member.
* The original connection entries remain on the original member.
* The IDLE timers of the original entries start to count down.
* When the IDLE timer reaches the TCP connection timeout configured in the Global Stateful Inspection properties, the original entries are deleted automatically.

## Cause

In a Load Sharing cluster, active connections may be redistributed between members after events such as a policy installation or cluster membership change. The original connection entry on the previous member becomes stale and eventually expires, causing the deletion to be synchronized to the member that is handling the active connection.

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  

For faster resolution and verification, collect these files:  
[CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member / Security Group involved in the case.  

Hotfix installation instructions:  
Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).  

**Workaround**

**Important** - Use this workaround only until the Hotfix is installed.

1. Connect to the Security Gateway command line in Expert mode.
2. Run   

   ```
   fw ctl set -f int ccl_force_sticky 1
   ```

The kernel parameter takes effect immediately and does not require a Security Gateway reboot.

**Note** - The command adds a persistent configuration entry to:

```
$FWDIR/boot/modules/fwkern.conf
```

**Expected Result**

Long-duration connections remain associated with the same cluster member and are not affected by the stale connection synchronization condition.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content