> Source: [sk124732](https://support.checkpoint.com/results/sk/sk124732)

# sk124732 - Traffic is not NATed correctly

| Property | Value |
|----------|-------|
| Solution ID | sk124732 |
| Date Created | 2018-04-17 |
| Last Modified | 2020-01-30 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * NAT traffic is dropped and not handled correctly.
* Kernel debug shows:

  ```
  
  ^fw_log_drop_ex: Packet proto=6 xxx.xxx.xxx.xxx:62816 -^ xxx.xxx.xxx.xxx:5061 dropped by fw_conn_post_inspect Reason: fwconn_key_init_links (OUTBOUND) failed^
  ^[cpu_47]^[fw4_0]^fw_log_drop_ex: Packet proto=6 xxx.xxx.xxx.xxx:56425 -^ xxx.xxx.xxx.xxx:443 
  dropped by fw_conn_post_inspect Reason: fwconn_key_init_links (OUTBOUND) fail ...
  ```

* When using ClusterXL with Dynamic NAT, after a failover there is traffic loss that lasts a few minutes.

## Cause

After a failover, the member that changed its state to ACTIVE initiates a rebuild of the tables for Dynamic Port Allocation. This process is heavy, especially if the concurrent number of NATed connections is large. (These tables are not synced between members, so they need to be rebuilt upon failover.)

During this process, Port Allocation can not be done, so every new connection that needs to be NATed will be dropped.

Dropped connections will not stay in the connection table without NAT and cause re-transmissions.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content