> Source: [sk167198](https://support.checkpoint.com/results/sk/sk167198)

# sk167198 - Fragmented traffic is dropped while using L4 Distribution

| Property | Value |
|----------|-------|
| Solution ID | sk167198 |
| Date Created | 2020-06-05 |
| Last Modified | 2023-05-05 |
| Technical Level | General |
| Products | Scalable Platforms |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |
| Platform | 6000 |

## Symptoms

- * Traffic is dropped by the rulebase when using L4 Distribution on a Maestro device.
* Correction is not applied to the fragmented packets of the connection.
* Adding a dedicated rule of the specific traffic resolves the issue.
* zdebug is showing: Virtual defragmentation error

## Cause

Layer 4 distribution adds the Source and/or Destination ports to the distribution equation (based on the configured distribution mode).  

When fragmentation occurs, the first fragmented packet contains the entire 5 tuple. However, the following fragmented packet does not hold the ports.  

In this case, each of the following fragmented packets is distributed based on Layer 3 alone. This may cause the fragmented packet to arrive to a different member, making it impossible to assemble all the fragmentation data.

<br />

## Solution

This issue was fixed. The fix is included in:

* **[Jumbo Hotfix Accumulator for R81](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170114) starting from Take 34**
* **[Jumbo Hotfix Accumulator for R80.20SP](https://supportcenter.us.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk155832) in take 283
  (Note: this issue was fixed in Gateway mode. A fix for VSX mode is planned.)**

You can also [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.   
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.   
For faster resolution and verification please collect [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) files from the Security Management and Security Gateways involved in the case.  

**Note:** The fix consists of two parts. One is to be be installed on the Orchestrator, the other on all members of the security group.   

As an immediate **workaround** , you can disable Layer 4 distribution in the gclish:   

Set the distribution mode to only relay Layer 3 information. This will cause all fragmentation to reach the same member, and will preserve the ability to assemble the full data.  

*\> show distribution l4-mode*   
*\> set distribution l4-mode disabled*   

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content