> Source: [sk164712](https://support.checkpoint.com/results/sk/sk164712)

# sk164712 - Traffic distribution inconsistency between Orchestrators and Security Gateways

| Property | Value |
|----------|-------|
| Solution ID | sk164712 |
| Date Created | 2020-01-15 |
| Last Modified | 2025-10-28 |
| Technical Level | General |
| Products | Scalable Platforms |
| Versions | R82.20, R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * TCP out of state drops:
  * TCP packets are dropped on "`First packet isn't SYN`".
  * TCP state violation.
* UDP packets are dropped because they were not matched on a rule-base accept rule.
* Traffic latency.

## Cause

### Root Cause # 1

Trunk interface, which was introduced in J[umbo Hotfix Accumulator Take 178](https://support.checkpoint.com/results/sk/sk155832), is only supported in "General with L4 enabled" distribution mode.

However, the distribution mode was configured to auto-topology (per-port), or L4 distribution mode was disabled.

In order to validate this root cause, do the following. If all of the below apply, proceed to the solution below.

1. Verify that Trunk interface is configured:
   1. In the Orchestrator's WebUI, non-VLAN interface is attached to the Security Group (e.g., eth2-51 instead of eth2-51.3009).
   2. On the Orchestrator, uplink trunk mode is enabled.  
      Run the following in Expert mode:  
      `# jsont -f /etc/maestro.json -g /uplink_trunk_mode/state`  
      * If it is enabled, the following will appear:  
        `enabled`
      * If it is disabled, the following will appear:  
        `disabled`  
        or  
        `key doesn't exist`
   3. On the Security Group, VLAN interfaces were configured (e.g., eth2-51.3009).
2. Verify that the Distribution configuration on the Gateway is not "General with L4 enabled". Run the following commands via the Gateway gclish:
   1. `show distribution configuration`
   2. `show distribution l4-mode`

### Root Cause # 2

Interface distribution mode is not identical on the Orchestrator and on the Gateways.

To confirm that there is a traffic distribution mismatch:

1. Verify that the Distribution configuration on the Gateway is not "General with L4 enabled". Run the following commands via the Gateway gclish:
   1. `show distribution configuration`
   2. `show distribution l4-mode`
2. Distribution configuration on one of Orchestrator's interfaces is General L4 ('`sym_l4`' in the configuration file):  
   On the Orchestrator, run the following in Expert mode:  
   `# cat /etc/mlx_conf.json | grep sym_l4 | head -n1`  
   If this output appears, then one of the interfaces is configured with General L4:  
   `"hash_type" : "sym_l4"`

**Note** - Only interfaces which belong to the Firewall policy are relevant.

## Solution

### Solution for Root Cause # 1:

Create the VLAN interfaces on the Orchestrator and attach them to the Security Group.

For example, create eth2-51.3009 and attach it to the relevant Security Group instead of eth2-51.

**Note**: Beginning in an upcoming Jumbo Hotfix Take, uplink trunk mode will be disabled by default. It will be possible to enable it from the command line.

### Solution for Root Cause # 2

This problem was fixed. The fix is included in:

* **[Check Point R80.20SP Jumbo Hotfix Take 210](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk155832&partition=General&product=Scalable)**

The following **workaround** is available for previous versions:

Run this command in Expert mode on the SMO of the relevant Security Groups:  
`distutil update`

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content