> Source: [sk161173](https://support.checkpoint.com/results/sk/sk161173) # sk161173 - Traffic fails when traversing over Multi Bridge Mode | Property | Value | |----------|-------| | Solution ID | sk161173 | | Date Created | 2019-08-26 | | Last Modified | 2026-08-10 | | Technical Level | General | | Products | Security Gateway | | Versions | R81.20, R81.10 (EOS), R81 (EOS) | ## Symptoms - * Traffic fails when traversing over the firewall in Bridge Mode while SecureXL is enabled (GW or VSX mode) * When SecureXL is enabled, the traffic fails without drop message. Disabling SecureXL will immediately resolve the issue. * SYN passes twice before reaching the destination. Ex: source \> bridge0 \> bridge1 \> bridge1.1 \> bridge0.1 \> destination ## Cause The traffic is inspected twice due to SYN packet being seen twice. **This is not a supported configuration, and is not related to SecureXL.** **Kernel debug can be performed to confirm the issue:** *fw ctl debug -buf 32000* *fw ctl debug -m fw + conn vm drop route* *fwaccel dbg -m general + init offload drop del stat* *fwaccel dbg -m api + stop add del* *fwaccel dbg -m db + init add del routing* *sim dbg -m pkt + f2f pkt drop routing* *sim dbg -m mgr + init add del stat* *sim dbg -m db + init get save del err* *sim dbg -m drv + init deliver pkt drv routing* *sim dbg -m err + er* **With SXL off:** ;10Jul2019 18:33:52.237164;\[vs_2\];\[tid_0\];\[fw4_0\];Before VM: \ 10.218.13.155:84 IPP 6\> (len=60) TCP flags=0x2 (SYN), seq=737b9f2e, ack=0, data end=737b9f2f (**ifn=31** ----\> bond2.123) (first seen) ; ;10Jul2019 18:33:52.237359;\[vs_2\];\[tid_0\];\[fw4_0\];After VM: \ 10.218.13.155:84 IPP 6\> (len=60) TCP flags=0x2 (SYN), seq=737b9f2e, ack=0, data end=737b9f2f ; ;10Jul2019 18:33:52.237498;\[vs_2\];\[tid_0\];\[fw4_0\];Before VM: \ 10.218.13.155:84 IPP 6\> (len=60) TCP flags=0x2 (SYN), seq=737b9f2e, ack=0, data end=737b9f2f (**ifn=22** ----\> bond1.123) (looked up) ; ;10Jul2019 18:33:52.237523;\[vs_2\];\[tid_0\];\[fw4_0\];After VM: \ 10.218.13.155:84 IPP 6\> (len=60) TCP flags=0x2 (SYN), seq=737b9f2e, ack=0, data end=737b9f2f ; ;10Jul2019 18:33:52.237638;\[vs_2\];\[tid_0\];\[fw4_0\];Before VM: \ 10.218.13.155:84 IPP 6\> (len=60) TCP flags=0x2 (SYN), seq=737b9f2e, ack=0, data end=737b9f2f (**ifn=27** ----\> bond1.113) (first seen) ; ;10Jul2019 18:33:52.237665;\[vs_2\];\[tid_0\];\[fw4_0\];After VM: \ 10.218.13.155:84 IPP 6\> (len=60) TCP flags=0x2 (SYN), seq=737b9f2e, ack=0, data end=737b9f2f ; ;10Jul2019 18:33:52.237727;\[vs_2\];\[tid_0\];\[fw4_0\];Before VM: \ 10.218.13.155:84 IPP 6\> (len=60) TCP flags=0x2 (SYN), seq=737b9f2e, ack=0, data end=737b9f2f (**ifn=32** ) (looked up) ; ;10Jul2019 18:33:52.237740;\[vs_2\];\[tid_0\];\[fw4_0\];After VM: \ 10.218.13.155:84 IPP 6\> (len=60) TCP flags=0x2 (SYN), seq=737b9f2e, ack=0, data end=737b9f2f ; As you can see SYN packet entered in interface 31 - and is leaving from interface 22. SAME SYN PACKET coming back to the GW - in interface 27 and leaving from interface 32. **This is OK with SXL off.** **With SXL on:** ;10Jul2019 18:33:09.686618;\[vs_2\];\[tid_0\];\[fw4_0\];Before VM: \ 10.218.13.155:84 IPP 6\> (len=60) TCP flags=0x2 (SYN), seq=c80fd9f8, ack=0, data end=c80fd9f9 (ifn=31) (first seen) ; ;10Jul2019 18:33:09.686897;\[vs_2\];\[tid_0\];\[fw4_0\];After VM: \ 10.218.13.155:84 IPP 6\> (len=60) TCP flags=0x2 (SYN), seq=c80fd9f8, ack=0, data end=c80fd9f9 ; ;10Jul2019 18:33:09.686992;\[vs_2\];\[tid_0\];\[fw4_0\];Before VM: \ 10.218.13.155:84 IPP 6\> (len=60) TCP flags=0x2 (SYN), seq=c80fd9f8, ack=0, data end=c80fd9f9 (ifn=22) (looked up) ; ;10Jul2019 18:33:09.687020;\[vs_2\];\[tid_0\];\[fw4_0\];After VM: \ 10.218.13.155:84 IPP 6\> (len=60) TCP flags=0x2 (SYN), seq=c80fd9f8, ack=0, data end=c80fd9f9 ; **The SYN packet is compared to an existing connection that is not yet completed, which causes issues. In a normal network, we should not see this.** ## Solution This feature is not included in the product. If you need it, please submit a [Request for Enhancement](https://www.checkpoint.com/rfe/login.htm). As a workaround you can exclude IP addresses or networks from SecureXL. For more information, see sk104468. --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content