> Source: [sk148432](https://support.checkpoint.com/results/sk/sk148432)

# sk148432 - Sporadic UDP (clear/encapsulated in tunnel) disconnection during install policy

| Property | Value |
|----------|-------|
| Solution ID | sk148432 |
| Date Created | 2019-03-05 |
| Last Modified | 2022-02-08 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- The following drop is seen in the */var/log/messages* file:  
`
simi_reorder_enqueue_packet: reached the limit of maximum enqueued packets for conn <>, app: F2V`  


**Note:** make sure the error is due to "F2V" app  


This may be followed by specific UDP session termination / slowness.

## Cause

SecureXL queue, designated for ensuring packets order, is reaching its limit.  
This is primarily caused due to unique behavior of UDP-based applications.

## Solution

Security Gateway operation does not require UDP to be ordered. Consequently, upon recognizing a UDP connection, order will not be enforced.

* **For Clear UDP connections** - Fix is included in:  
  * [Check Point R80.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk144293)
  * [Check Point R80.30SP](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk162552)
  * [Jumbo Hotfix Accumulator for R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592) - starting from Take 74
  * [Jumbo Hotfix Accumulator for R80.20SP](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk155832) - starting from Take 305

  Check Point recommends to always upgrade to the most recent version ([upgrade Security Gateway](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=435) / [upgrade Cluster](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=428)).
* **For tunneled UDP or UDP-based protocols (for example GRE):**   

  This problem was fixed. The fix is included in:
  * [Check Point R81](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk166715)
  * [Jumbo Hotfix Accumulator for R80.40](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456) starting from Take 69
  * [Jumbo Hotfix Accumulator for R80.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk153152) starting from Take 215
  * [Jumbo Hotfix Accumulator for R80.30SP](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165312) starting from Take 45
  * [Jumbo Hotfix Accumulator for R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592) starting from Take 173
  * [Jumbo Hotfix Accumulator for R80.20SP](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk155832) - starting from Take 305

  If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
  A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
  For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

After the Jumbo Hotfix installation, edit the file: ***$PPKDIR/conf/simkern.conf*** to add the line/s with the protocol number/s that should not use the reorder infrastructure, and restart the Security Gateway.

**Note:**Up to 3 protocols can be excluded from being reordered by SecureXL, using the following syntax:

**`simi_reorder_prevent_hold_proto_1=<1st_protocol_number>`
`
simi_reorder_prevent_hold_proto_2=<2nd_protocol_number>`
`
simi_reorder_prevent_hold_proto_3=<3rd_protocol_number>`**

For example, for GRE - add the line:

**`simi_reorder_prevent_hold_proto_1=47`**

Note:

* No spaces or empty lines are allowed in the file.
* For protocol numbers refer to <https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml>

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content