> Source: [sk109216](https://support.checkpoint.com/results/sk/sk109216)

# sk109216 - Unresolved Dynamic Object causes NAT rule matching to fail and packet drop

| Property | Value |
|----------|-------|
| Solution ID | sk109216 |
| Date Created | 2015-12-21 |
| Last Modified | 2018-09-04 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * Unresolved Dynamic Object causes NAT rule matching to fail and packet drop.
* In the kernel debug we see the following drops:  
  ;18Sep2015 8:25:57.464175;\[cpu_13\];\[fw4_2\];fw_xlate_find_all_matches: Returning 2 for resolving of dynamic object;  
  ;18Sep2015 8:25:57.464178;\[cpu_13\];\[fw4_2\];fw_xlate_match: Returning vanish or hold (2) for dynamic object resolving;  
  ;18Sep2015 8:25:57.464194;\[cpu_13\];\[fw4_2\];fw_log_drop_ex: Packet proto=1 \[IP Address:Port\] -\> \[NATTed IP Address:Port\] dropped by fw_first_packet_xlation Reason: Dynamic object is already being resolved;
* Even if there is a matching rule with a higher priority (and no issues), a rule with a lower priority that fails to resolve a dynamic object will cause the rule matching to fail and drop the packet.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content