> Source: [sk131414](https://support.checkpoint.com/results/sk/sk131414)

# sk131414 - Network outage when using Security Zones objects

| Property | Value |
|----------|-------|
| Solution ID | sk131414 |
| Date Created | 2018-07-28 |
| Last Modified | 2019-01-09 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Network outage is observed when the rulebase contains Security Zones objects.
* In ClusterXL environments, failover is not being initiated automatically; the issue is resolved with a manual failover or a reboot.
*

  ```
  
  kernel: BUG: soft lockup - CPU#X stuck for 10s! [ksoftirqd/2:9]
  kernel: CPU X:
  ?
  kernel: Call Trace:
  kernel:    [] _spin_lock_bh+0x9/0x20
  kernel:  [] rt_garbage_collect+0x120/0x360
  kernel:  [] dst_alloc+0x81/0xa0
  kernel:  [] ip_route_input+0xcbb/0xf10
  ```

* "kernel: dst cache overflow" messages in `/var/log/messages` (or `dmesg`).
* Leftmost value of `grep ip_dst_cache /proc/slabinfo` is higher than the one in `cat /proc/sys/net/ipv4/route/max_size`.

## Cause

The SecureXL routing code does not release the routing cache back to the OS, causing more and more entires to become stuck until the limit for the number of routing caches is reached.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content