> Source: [sk137392](https://support.checkpoint.com/results/sk/sk137392)

# sk137392 - During policy installation, the Security Gateway loses some active connections even though the connections are allowed by the Access Control Policy

| Property | Value |
|----------|-------|
| Solution ID | sk137392 |
| Date Created | 2018-10-01 |
| Last Modified | 2018-10-03 |
| Technical Level | Advanced |
| Products | Security Gateway, Cloud Firewall |
| Versions | R82.10, R82, R81.20, R82.10, R81.20, R82 |

## Symptoms

- * During policy installation, the Security Gateway loses some active connections even though these connections are allowed by the Access Control Policy. (The domain objects are configured in the Access Control policy as a non-FQDN Domains.)
* While the issue occurs, *# fw ctl debug -m fw + drop* does not show any drops for legitimate traffic.

## Cause

To see the cause of this issue, use a kernel debug with the following modules and flags:

# fw ctl debug 0

# fw ctl debug -buf 32000

# fw ctl debug -m fw + drop

# fw ctl debug -m UP + connection rulebase info error warning

# fw ctl kdebug -T -f \> /var/log/kernel_debug.dbg

Review the kernel debug:

\[fw4_3\];network_classifier_cmi_handler_match_cb: context is UP_MANAGER_POST_SYN_CTX;

\[fw4_3\];network_classifier_cmi_handler_match_cb: src_domain_required = 0, dest_domain_required = 1;

\[fw4_3\];network_classifiers_domain_handle_post_syn_context: destination ip = 1.2.3.4;

\[fw4_3\];network_classifiers_domain_handle_post_syn_context: SUB domain in rulebase;

\[fw4_3\];network_classifiers_domain_handle_post_syn_context: Post-SYN, look in the cache before sending trap to DNS for the IP address;

\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

\[fw4_3\];\[WARNING\]: network_classifiers_domain_handle_post_syn_context: IP resolving for ip 1.2.3.4 is in progress (for 2 seconds), drop connections with this IP until resolving is finished;

\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*\*

\[fw4_3\];up_manager_fw_handle_first_packet: drop action was resolved in post-syn context;

\[fw4_3\];up_manager_fw_handle_first_packet: action != ACCEPT, rule_num (including sub policy id) = 0x 11;

\[fw4_3\];up_manager_fw_handle_first_packet: destroying rule base handle ffffc2002f6f8618;

\[fw4_3\];up_handle_destroy: called for ffffc2002f6f8618;

\[fw4_3\];up_rulebase_get_layer_name_by_id: called;

\[fw4_3\];fw_log_drop_ex: Packet proto=6 4.3.2.1:55920 -\> 1.2.3.4:110 dropped by fw_send_log_drop Reason: Rulebase drop - on layer "CPModules Security" rule XX;

**Where rule XX as an accept rule, which should allow this traffic.**

**Domain object resolution takes a long time, and the connection is dropped in the meantime.**

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content