> Source: [sk106288](https://support.checkpoint.com/results/sk/sk106288)
# sk106288 - HTTP traffic is blocked by Application Control with "HTTP parsing error occurred, blocking request (as configured in engine settings)" log
| Property | Value |
|----------|-------|
| Solution ID | sk106288 |
| Date Created | 2015-05-31 |
| Last Modified | 2025-01-06 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
## Symptoms
- * SmartView Tracker log from Application Control shows that HTTP traffic was blocked:
"`HTTP parsing error occurred, blocking request (as configured in engine settings)`"
* (fw ctl zdebug drop) shows: ;\[cpu_1\];\[fw4_2\];fw_log_drop_ex: Packet proto=6 IP_Address:proxy_port- \> IP_address:random_ports dropped by fwpslglue_chain Reason: PSL Reject: HTTP_DISPATCHER;
## Cause
Starting in R77.30, the HTTP inspection was improved to be stricter.
IPS protection "*Non Compliant HTTP*" has detected either an HTTP Response that does not correspond to any HTTP Request, or redundant CR/LF characters (\\r\\n) at the end of the previous valid HTTP Response.
Such a scenario usually occurs when a proxy server sends a non-compliant HTTP redirect response: the HTTP response has some HTTP data, but either does not have the "*Content-Length* " header, or the value in the "*Content-Length*" header is 0 (zero).
## Solution
**Code was improved:**
* Security Gateway's behavior can now be controlled by the kernel parameter ***ws_ignore_http_resp_wo_req_error***:
|------------------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| Value | Security Gateway's Behavior |
| ws_ignore_http_resp_wo_req_error=1 | Note: This is the default value in Security Gateway R77.30 and lower. *Ignore* HTTP Response that does not correspond to any HTTP Request (sending redundant CR/LF characters (\\r\\n) at the end of the previous valid HTTP Response is a non-standard, but legal behavior). |
| ws_ignore_http_resp_wo_req_error=0 | Note: This is the default value in Security Gateway R80.10 and higher. *Block* HTTP Response that does not correspond to any HTTP Request (act according to the IPS policy configured in IPS protection "Non Compliant HTTP"). If Security Gateway fails to find a read session in HTTP traffic, then: 1. If the received HTTP data consists only of CRLF characters, then continue as previously (redundant CRLF characters were sent at the end of the previous HTTP Response - non-standard behavior, but legal). 2. Otherwise, an HTTP Response was received before any HTTP Request was sent, so consider this HTTP traffic as non-compliant and act according to the IPS policy configured in IPS protection "Non Compliant HTTP". |
Procedure to *block* HTTP Response that does not correspond to any HTTP Request (stricter behavior):
*
### Instructions for R77.30
Follow [sk26202 - Changing the kernel global parameters for Check Point Security Gateway](http://supportcontent.checkpoint.com/solutions?id=sk26202).
**Note:** In cluster environment, this procedure must be performed on *all* members of the cluster. Parameter cannot be set on the fly.
> For Gaia / SecurePlatform OS:
> 1. Create the *$FWDIR/boot/modules/fwkern.conf* file (if it does not already exist):
>
> ***\[Expert@HostName\]# touch $FWDIR/boot/modules/fwkern.conf***
>
> 2. Edit the *$FWDIR/boot/modules/fwkern.conf* file in Vi editor:
>
> ***\[Expert@HostName\]# vi $FWDIR/boot/modules/fwkern.conf***
>
> 3. Add the following line (spaces are not allowed):
>
> ***ws_ignore_http_resp_wo_req_error=0***
>
> 4. Save the changes and exit from Vi editor.
>
> 5. Check the contents of the *$FWDIR/boot/modules/fwkern.conf* file:
>
> ***\[Expert@HostName\]# cat $FWDIR/boot/modules/fwkern.conf***
>
> 6. Reboot the Security Gateway.
>
> 7. Verify that the new value was set:
>
> ***\[Expert@HostName\]# fw ctl get int ws_ignore_http_resp_wo_req_error***
*
### Instructions for R77.20 and lower
[Contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) to get a Hotfix for this issue.
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.
**Note:** This hotfix is already included in:
* [Jumbo Hotfix Accumulator for R77.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk101975) - since *Take_124*
Procedure:
1. Hotfix has to be installed on ***Security Gateway***.
**Note:** In cluster environment, this procedure must be performed on *all* members of the cluster.
2. Transfer the hotfix package to the Security Gateway / each cluster member (into some directory, e.g., `/some_path_to_fix/`).
3. Unpack and install the hotfix package:
***\[Expert@HostName\]# cd /some_path_to_fix/***
***\[Expert@HostName\]# tar -zxvf fw1_wrapper_\.tgz***
***\[Expert@HostName\]# ./fw1_wrapper_\***
Note: The script will stop all of Check Point services ('`cpstop`') - read the output on the screen.
4. Do NOT reboot yet.
5. *Permanently* set the value of kernel parameter "*ws_ignore_http_resp_wo_req_error*" to 0 (zero).
Note: Follow [sk26202 - Changing the kernel global parameters for Check Point Security Gateway](http://supportcontent.checkpoint.com/solutions?id=sk26202).
> For Gaia / SecurePlatform OS:
> 1. Create the *$FWDIR/boot/modules/fwkern.conf* file (if it does not already exist):
>
> ***\[Expert@HostName\]# touch $FWDIR/boot/modules/fwkern.conf***
>
> 2. Edit the *$FWDIR/boot/modules/fwkern.conf* file in Vi editor:
>
> ***\[Expert@HostName\]# vi $FWDIR/boot/modules/fwkern.conf***
>
> 3. Add the following line (spaces are not allowed):
>
> ***ws_ignore_http_resp_wo_req_error=0***
>
> 4. Save the changes and exit from Vi editor.
>
> 5. Check the contents of the *$FWDIR/boot/modules/fwkern.conf* file:
>
> ***\[Expert@HostName\]# cat $FWDIR/boot/modules/fwkern.conf***
6. Reboot the Security Gateway.
7. Verify that the new value was set:
***\[Expert@HostName\]# fw ctl get int ws_ignore_http_resp_wo_req_error***
**Related solutions:**
* [sk103113 - RTSP over HTTP traffic might cause high CPU load on Security Gateway when HTTP inspection on non standard ports is enabled](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk103113)
---
# Agent Instructions
This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.
## Navigating This Knowledge Base
- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content