> Source: [sk116160](https://support.checkpoint.com/results/sk/sk116160)

# sk116160 - Computers with dynamically assigned IP addresses are not able to access web sites by their URLs when SecureXL is enabled

| Property | Value |
|----------|-------|
| Solution ID | sk116160 |
| Date Created | 2017-03-02 |
| Last Modified | 2019-11-19 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Users are intermittently not able to connect to web sites through Security Gateway in the following scenario:

  1. Topology:  
     * Users receive an IP address from a DHCP Server.
     * DHCP Server and DNS server are located behind the Security Gateway.
     * A new IP address is assigned after user disconnects from a network and reconnects.

     [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk116160/Logical_Topology.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk116160/Logical_Topology.png "Click the image to see it in full size in a new tab/window")
  2. SecureXL is enabled on the Security Gateway.
  3. When user connects for the first time, access to web sites by their URLs works correctly.
  4. After user disconnects and reconnects for the second time, access to web sites by their URLs stops working intermittently.  
     It is possible to access web sites only by their IP addresses.
* Checking the ARP table on the Security Gateway (with "`arp -nv`", "`ip -s -s -4 neigh show`" commands) during the issue shows the following:

  * IP address of the user's computer, who experiences this issue, is associated with a wrong MAC Address
  * The relevant entry is refreshed and associated with the correct MAC Address only in the following cases:  
    * some traffic (e.g., ping) is sent from the Security Gateway to the IP address of the user's computer
    * SecureXL is disabled ('`fwaccel off`') and reenabled ('`fwaccel on`') on the Security Gateway
    * user tries to access web sites by their IP addresses
* This issue does not occur for users, whose computers are configured with static IP addresses.

* Disabling SecureXL on the Security Gateway resolves the issue.

## Cause

SecureXL is using previously cached MAC address (associated with the involved IP address) for accelerated connections sent from Server to Client (in this case, packets sent from the DNS server to the Client).

For F2F packets, the OS is aware that this IP-to-MAC address mapping is stale, so it sends an ARP Request for the IP address and updates the cache with the correct value.  
However when SecureXL queries for the MAC address, the ARP Request is not sent. As a result, SecureXL is using previously cached MAC address (associated with the involved IP address).

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content