> Source: [sk120797](https://support.checkpoint.com/results/sk/sk120797)

# sk120797 - Transfer of large files via http or ftp through the Security Gateway does not complete

| Property | Value |
|----------|-------|
| Solution ID | sk120797 |
| Date Created | 2017-10-17 |
| Last Modified | 2018-01-02 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Upload / Download or transfer of large files via http or ftp through the Security Gateway does not complete and fails after a few kilobytes.
* Use of TCP Selective Acknowledgement is enabled on server and application. Epic Home Health is one application example.
* SmartView Tracker shows packets dropped due to Out of State, Out of Sequence.
* Doing packet captures at the server side will show the Sequence numbers do not match up after the first Acknowledgement. At that point the server goes into a retransmission state and eventually stop all conversations with the client.
* In Wireshark, disable "Relative Sequence numbers". Then a tcpdump or fw monitor packet capture will show the TCP sequence numbers change from outside to inside.
* In SmartDashboard IPS tab - Protections pane, the Security Gateway has IPS enabled with protection ISN Spoofing active.

## Cause

Redhat 7 OS and applications like EPIC Home Health or SFTP processes can utilize TCP Selective Acknowledgment (SACK) to improve TCP performance. Disabling TCP SACK will actually hurt performance.

[sk39125](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk39125) defines TCP Selective Acknowledgment (SACK) and says SACK option alters the Sequence number acknowledgement behavior. See [RFC 2018](https://www.ietf.org/rfc/rfc2018.txt).

According to [sk97619 - Check Point R77.10 Known Limitations](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk97619), "TCP SACK (Selective Acknowledgment) option is not supported with IPS protection 'ISN Spoofing'."

In later versions a parameter was added, and left in "off" state by default.

ISN Spoofing randomizes the Sequence numbers so they can't be guessed and hijacked.

Note: Some hardware and OS's, like IBM AIX unix or Suse 11, do not support or have disabled TCP SACK by default. Applications running on these systems will not be able to use TCP SACK regardless of the intermediate Firewall settings.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content