> Source: [sk148652](https://support.checkpoint.com/results/sk/sk148652)

# sk148652 - VSX Gateway with Virtual Router does not pass traffic when SecureXL is enabled

| Property | Value |
|----------|-------|
| Solution ID | sk148652 |
| Date Created | 2019-03-07 |
| Last Modified | 2022-01-30 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Topology:  
  * A VR with an External Interface leads to the Internet.
  * 2 or more VSs, each with an Internal Interface leads to a private Network, and an External WRP Interface leads to the VR.
* Send traffic from one VS to the other through the VR.
* No drops can be found in Kernel debug (fw ctl zdebug drop).
* 'fw monitor' shows the packet only in the inbound chain (small "i").
* Disabling SecureXL solve the issue.

## Cause

When SecureXL is on, packets bypass the VS and leave directly using the external interfaces (this is also called: warp_jump mechanism). In a topology with a Virtual Router, the traffic needs to traverse through the VR as well.

The Warp interfaces belonging to a VR do not have Layer 2 information, and as a result, the packets are sent to the VR without a MAC header and are dropped.

## Solution

This problem was fixed. The fix is included starting from:

* [Check Point R80.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk144293)

Check Point recommends to always upgrade to the most recent version   
([upgrade Security Gateway](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=435) / [upgrade Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=184) / [upgrade Multi-Domain Security Management](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=166)).

<br />

The code was improved.  

In the above scenario, SecureXL will enter the proper MAC header to the packets, so the OS could handle the packets.  

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).

<br />

<br />

**Related solution:** [sk160352: Traffic drops when SecureXL is enabled on VSX after upgrade](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk160352)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content