> Source: [sk164839](https://support.checkpoint.com/results/sk/sk164839)

# sk164839 - SYN packets are dropped by SecureXL

| Property | Value |
|----------|-------|
| Solution ID | sk164839 |
| Date Created | 2020-02-04 |
| Last Modified | 2021-01-27 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * SYN packets are dropped by SecureXL. The connection in the connection table is in a half closed state via a FIN/ACK from the server to client or client to server.  

* Running Kernel debug (fw ctl zdebug + drop), similar logs can be seen:  
  `@;3654790;[cpu_0];[SIM-206691232];update_tcp_state: invalid response to FIN;`  
  `
  @;3654790;[cpu_0];[SIM-206691232];update_tcp_state: invalid state detected (current state: 0x80000, th_flags=0x2, cdir=0) -> 
  dropping packet, conn: [<X.X.143.186,55552,X.X.143.25,443,6>][PPK0];`  
  `
  @;3654790;[cpu_0];[SIM-206691232];do_inbound: Possible TCP state violation for <X.X.143.186,55552,X.X.143.25,443,6> -> dropping packet ;`  
  `
  @;3654790;[cpu_0];[SIM-206691232];do_packet_finish: SIMPKT_IN_DROP vsid=0, conn:<X.X.143.186,55552,X.X.143.25,443,6>;`

## Cause

The Security Gateway is receiving a SYN packet on an existing half closed connection with the same five tuple in the connection table.

Client to Server connections are not closed completely before ports are reused for new connections.

## Solution

Configure traffic to close down connections correctly so the connection is removed from the firewall.  

Or  

This problem was fixed. The fix is included in:  

[Jumbo Hotfix Accumulator for R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592&partition=General&product=All%22) from Take 160  
Jumbo Hotfix Accumulator for R80.30 from Take 163

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.   
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.   
For faster resolution and verification please collect [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) files from the Security Management and Security Gateways involved in the case.

A Workaround of Identifying the connection in the connection table and removing it for the problematic port/connection is also available.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content