> Source: [sk109735](https://support.checkpoint.com/results/sk/sk109735)

# sk109735 - "TCP packet out of state: First packet isn't SYN; tcp_flags: SYN-ACK" drop log when SecureXL and Application Control / URL Filtering blade are enabled on Security Gateway in Bridge mode

| Property | Value |
|----------|-------|
| Solution ID | sk109735 |
| Date Created | 2016-01-20 |
| Last Modified | 2020-02-13 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Traffic is dropped with "`TCP packet out of state: First packet isn't SYN; tcp_flags: SYN-ACK`" log in SmartView Tracker in the following scenario:

  * Security Gateway is configured in Bridge mode
  * SecureXL is enabled
  * Topology:  
    Client --- (physical non-Bridge interface eth*Z* ) \[GW in Bridge mode\] (Bridge interface Br*N* on ports eth*X* ,eth*Y* ) --- Server  
  * Traffic Flow:  
    Connection from Client arrives to Security Gateway at physical non-Bridge interface eth*Z*   
    Connection to Server leaves the Security Gateway from Bridge interface port eth*X*
  * Application Control blade / URL Filtering blade is enabled
* SecureXL SIM debug shows that when SecureXL SIM devices tries to accelerate a packet that arrived at physical non-Bridge interface, the accelerated packet is cut through to the Bridge interface Br\<N\> instead of Bridge interface port eth*X*:

  Debug modules and flags:

  *fw ctl debug -m fw + packet*   

  *sim dbg -m pkt + pkt acct*   

  *sim dbg -m drv + deliver*

  **\*Note:** In R80.20 *sim dbg* is replaced with *fwaccel dbg*

  Relevant lines in debug output:
  `
  ;[SIM...]handle_inbound_packet: got packet on VSID=0 (ifnum=`*Number of Physical non-Bridge interface ethZ* `);`  
  `
  ;[SIM...]do_inbound: got packet 0x... on cpu 0 of <Source_IP_of_Client,Source_Port_on_Client,Dest_IP_of_Server,Dest_Port_on_Server,6>(vsid=0);`  
  `
  ... ... ...`  
  `
  ;[SIM...]do_cut_through: sending packet to outbound processing...; `  
  `
  ;[SIM...]do_outbound: got packet 0x... on cpu 1 of <Source_IP_of_Client,Source_Port_on_Client,Dest_IP_of_Server,Dest_Port_on_Server,6> (packet is cut-through); `  
  `
  ;[SIM...]ACCT <Source_IP_of_Client,Source_Port_on_Client,Dest_IP_of_Server,Dest_Port_on_Server,6>: p=1; b=48 (conn_dir=0, dir=1); `  
  `
  ;[SIM...]do_outbound: forwarding packet to network (ifnum=`*Number of Bridge interface Br<N>* `)...; `  
  `
  ;[SIM...]sim_filterout_do_deliver: delivered skb=0x..., on dev=`*Name of Bridge interface Br<N>* `, output_func=0x..., cut_through=1, rc=0; `  
  `
  ... ... ...`  
  `
  ;fwlinux_nfbrout:...:(`*<Name of Bridge interface port ethX>*`)
  `

## Cause

Connections between Bridge and non-Bridge interfaces are not accelerated correctly (the accelerated packet is cut through to the Bridge interface Br\<N\> instead of Bridge interface port eth*X*).

As a result, the accelerated packet enters the FireWall once again on outbound, which causes various inconsistencies.  
In particular, when Application Control blade / URL Filtering blade is enabled, due to a required routing decision, this causes the packet to being Forwarded from SecureXL to FireWall (F2F) and being dropped.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content