> Source: [sk118720](https://support.checkpoint.com/results/sk/sk118720) # sk118720 - SmartView Monitor "Top QoS Rules" view shows that almost all traffic matches the "No Match" rule when SecureXL is enabled | Property | Value | |----------|-------| | Solution ID | sk118720 | | Date Created | 2017-07-06 | | Last Modified | 2021-07-06 | | Technical Level | General | | Products | Security Gateway, SmartConsole | | Versions | R81.10 (EOS), R81 (EOS) | | OS | Gaia | ## Symptoms - * SmartView Monitor "Top QoS Rules" view shows that almost all traffic matches the "No Match" rule. *Example* : [![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk118720/No_Match.jpg)](https://sc1.checkpoint.com/sc/SolutionsStatics/sk118720/No_Match.jpg "Click the image to see it in full size in a new tab/window") * Kernel debug ('`fw ctl debug -m RTM + rtm view_add per_conn`') on Security Gateway shows that sometimes SmartView Monitor fails to read the QoS rule. *Examples*: * ` ;svmClassifyKviews : [first time] Conn: =<[192.168.0.141(c0a8008d) 192.168.1.1(c0a80101)] [65054 53] [17]> cl_in: 1, cl_out: -1, s_in: -1, s_out: -1;` ` ;get_fg_matched_rules: Get rule for ifn 1, dir: 0;` ` ;get_fg_matched_rules: The ifn:1 is not active. (direction 0);` ` ;svmClassifyKviews : could not read matched rule from FloodGate; ` * ` ;svmClassifyKviews : [mismatch] Conn: <[192.168.0.141(c0a8008d) 192.168.1.1(c0a80101)] [65054 53] [17]>;` ` ;get_fg_matched_rules: Get rule for ifn 3, dir: 1;` ` ;get_fg_matched_rules: The ifn:3 is not active. (direction 1);` ` ;svmClassifyKviews : could not read matched rule from FloodGate; ` * In addition, whenever a new SmartView Monitor view is opened, the connections are re-classified, which causes "no-match" for a short moment. * Disabling SecureXL resolves the issue. ## Cause When SecureXL is enabled, interface information is saved in advance also for the other direction (in case the connection will be accelerated - i.e., if packet is 'Client-to-Server', then the same interface is saved for 'Server-to-Client' direction). However, since interface information is saved, an interface mismatch can not occur. As a result, a QoS rule is not reclassified (which is per direction, unlike in FireWall rules) for the other direction. ## Solution [Contact Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) to get a Hotfix for this issue. A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix. For faster resolution and verification, please collect [CPInfo files](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) from the Security Management Server and Security Gateways involved in the case. **Code was improved:** * QoS information is now saved for both directions when SecureXL is enabled. **Hotfix installation instructions:** 1. Hotfix has to be installed on ***Security Gateway***. **Note:** In cluster environment, this procedure must be performed on *all* members of the cluster. 2. Procedure: * Using CPUSE - On Security Gateway running Gaia OS R75.40 and above: Make sure to install the [latest build of the CPUSE Agent](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#Latest build of CPUSE and What's New). Refer to [sk92449: CPUSE - Gaia Software Updates (including Gaia Software Updates Agent)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE): * Section "[(4-A-c)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to download and import a CPUSE package - Import instructions for Offline procedure - Gaia Portal)" / "[(4-A-d)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to download and import a CPUSE package - Import instructions for Offline procedure - Gaia Clish)" - refer to import instructions for *Offline procedure* * Section "[(4-B-a)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to install a CPUSE package - Installing a Hotfix package / Minor Version package)" - refer to installation instructions for *Hotfixes* You can also use the [sk111158 - Central Deployment Tool (CDT)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk111158) to install this hotfix on Security Gateways. **Note:** Reboot is required. * Using Legacy CLI - On VSX Gateway running Gaia OS R75.40VS - R77.30; On Security Gateway running SecurePlatform/XOS/IPSO OS: Note: You must be connected either over Console, or LOM card (SSH session could be disconnected). On VSX versions R75.40VS - R77.30, the Gaia CPUSE does not support installation of hotfixes (refer to [sk92449](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#System requirements and limitations) - section "(2)" - "VSX Gateways"). 1. Transfer the hotfix package to the machine (into some directory, e.g., */some_path_to_fix/*). 2. Unpack and install the hotfix package: ***\[Expert@HostName\]# cd /some_path_to_fix/*** ***\[Expert@HostName\]# tar -zxvf fw1_wrapper_\.tgz*** ***\[Expert@HostName\]# ./fw1_wrapper_\*** **Note:** The script will stop all of Check Point services (*cpstop*) - read the output on the screen. 3. Reboot the machine. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content