> Source: [sk118415](https://support.checkpoint.com/results/sk/sk118415)

# sk118415 - TCP [FIN-ACK] packets for HTTPS traffic are dropped as out-of-state after enabling HTTPS Inspection

| Property | Value |
|----------|-------|
| Solution ID | sk118415 |
| Date Created | 2017-06-27 |
| Last Modified | 2020-11-29 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- TCP \[FIN-ACK\] packets for HTTPS traffic are dropped as out-of-state after enabling HTTPS Inspection:

1. HTTPS connection is established as expected between a Client and a Server (through Security Gateway)
2. Server sends a TCP \[FIN-ACK\] packet when the session is finished
3. Due to CPAS, Security Gateway sends:  
   1. TCP \[FIN-ACK\] packet to the Server
   2. TCP \[FIN-ACK\] packet to the Client
4. The gateway sets the connection to "closed" state, reducing it's timeout to the "end-session timeout" (20 seconds default)
5. After the timeout has passed, Client sends a TCP \[FIN-ACK\] packet to the Server
6. Security Gateway drops this TCP \[FIN-ACK\] packet (from the Client) as out-of-state:  
   `TCP packet out of state: First package isn't SYN`  
   `
   tcp_flags: FIN-ACK`  
   *Example of a drop log* :  
   [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk118415/Example.png)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk118415/Example.png "Click the image to see it in full size in a new tab/window")

## Cause

The connection is deleted from the Security Gateway's "Connections" kernel table after receiving the TCP \[FIN-ACK\] packet from the Server.

As a result:

1. The TCP \[FIN-ACK\] packet sent from the Client can not be found in the Security Gateway's "Connections" kernel table.
2. This TCP packet is treated as a new TCP connection, which, by definition, can not be a non-\[SYN\] packet.
3. This TCP \[FIN-ACK\] packet sent from the Client is dropped.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content