> Source: [sk109361](https://support.checkpoint.com/results/sk/sk109361)

# sk109361 - XFF header not stripped in some specific scenario

| Property | Value |
|----------|-------|
| Solution ID | sk109361 |
| Date Created | 2015-12-31 |
| Last Modified | 2024-04-02 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Although gateway is configured to strip X-forward-for header (per [sk100223](http://supportcontent.checkpoint.com/solutions?id=sk100223)), tcpdump on external interface shows that XFF header is not stripped.   

* WS debug shows:

  ```
  
  {session} [SID: xxxxx] ws_http_process_session_1st_response: Calling policy container to process general parser event 1;
  {module} [SID: xxxxx] ws_passive_primitives_cb: Passive implementation for E_WS_PRIMITIVE_REPLACE_HEADER_DATA called side WS_CLIENT_SIDE (18);
  {policy} [SID: xxxxx] ws_policy_process_general_parser_event: calling wpe signature finder;
  {stream} [SID: xxxxx] ws_stream_calc_infrastructure_stream_offset: found bucket - bucket number:2;
  {module} [SID: xxxxx] ws_passive_primitives_cb: [WARNING]: the header or part of it is not in PSL buffers. aborting ..
  ```

## Cause

Issue happens when packet divided to several fragments and XFF header start on a segment and ends on another segment (does not matter which one). Gateway checks the segments and then decides whether or not strip the XFF (under PSL - Passive Streaming Library).   
If the decision is to strip the XFF - Gateway should go back to the 1st segment that XFF appeared. BUT since the PSL already released it - Gateway cannot strip the XFF header from it.

## Solution

[Contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) to get a Hotfix for this issue.   
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.   
For faster resolution and verification please collect [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) files from the Security Management and Security Gateways involved in the case.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content