> Source: [sk111137](https://support.checkpoint.com/results/sk/sk111137)

# sk111137 - Traffic that matches Identity Awareness rules does not pass on IPSO 6.2 with enabled SecureXL

| Property | Value |
|----------|-------|
| Solution ID | sk111137 |
| Date Created | 2016-04-25 |
| Last Modified | 2016-04-26 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * Some traffic stops passing in the following scenario:

  1. Security Gateway runs on IPSO 6.2 OS
  2. SecureXL is enabled
  3. Identity Awareness blade is enabled
  4. Affected traffic matches Identity Awareness rules
* Disabling SecureXL resolves the issue.

* SecureXL debug shows:

  `
  cphwd_offload_connkey: calling cphwd_api_add_connection_, flags 0x..., flags_ex 0x0;`  
  `
  cphwd_add_conn_stat_cb: received add status for <dir 1, X.X.X.X:X -> Y.Y.Y.Y:Y IPP 6>(flags=0x..., cb_flags=0x0): success;`  
  `
  `**cphwd_offload_connkey: can't offload template because PSL prevents template offload;**   
  `
  cphwd_vpn_get_outbound_mspi_tag:no cphwd_get_outbound_mspi_tag_ptr;`  
  `
  handle_single_tag: Tag 0 added to the chain.;
  `
* Kernel and SecureXL debug of Network Access Control (NAC) layer ('`fw ctl debug -m fw + nac`' ; '`fwaccel dbg -m general + nac`') shows:

  `
  fwnac_offload_identity_if_needed: identity_index fetched; `  
  `
  fwnac_offload_identity_if_needed: offloading to SXL; `  
  `
  fwnac_convert_client_values_to_cphwd_nac_identity: <...>; `  
  `
  cphwd_api_add_identity_: <...>; `  
  `
  `**fwnac_offload_identity_if_needed: SXL NAC API not supported;**` `  
  `
  fwnac_get_nac_conn_info: [X.X.X.X, 00000000, ...] = 0; `  
  `
  prepare_nac_connkey_info: get_nac_coon_info returned identity_index = ..., nac_tagging = 0; `  
  `
  cphwd_offload_conn: calling cphwd_api_add_connection_, flags 0x..., flags_ex 0x8; `  
  `
  ---> cphwd_api_add_connection( `  
  `
  ... ... ...`  
  `
  `**cphwd_offload_conn: failed to add connection to accelerator (err: not_initialized)**`.
  `

## Cause

By design, the user *identity_index* is not offloaded to SecureXL on IPSO 6.2. However, if a connection is related to a Network Access Control (NAC), then the connection is incorrectly offloaded to the accelerator and it would fail.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content