> Source: [sk167361](https://support.checkpoint.com/results/sk/sk167361)

# sk167361 - Framed IP Address value is reversed when enabling radius_send_framed for RADIUS authentication

| Property | Value |
|----------|-------|
| Solution ID | sk167361 |
| Date Created | 2020-06-15 |
| Last Modified | 2025-01-06 |
| Technical Level | General |
| Products | Endpoint Security |
| Versions | Cloud, E89.X, E88.X |
| OS | Gaia |

## Symptoms

- When reviewing the RADIUS authentication request packet in Wireshark, user sees that the source IP of the client shows up in reversed octets in the Framed-IP-Address field (ie src IP is 1.2.3.4 but the Framed-IP-Address field shows up as 4.3.2.1)

## Solution

**Environment:** Global Properties \> Advanced \> Firewall-1 \> Authentication \> Radius settings \> ****radius_send_framed is enabled****

This problem was fixed. The fix is included in:

* [Check Point R81](https://support.checkpoint.com/results/sk/sk166715)
* [Jumbo Hotfix Accumulator for R80.40](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456) starting from Take 87
* [Jumbo Hotfix Accumulator for R80.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk153152) starting from Take 227
* [Jumbo Hotfix Accumulator for R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592) starting from Take 190

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

<br />

******For R81 or after the hotfix is installed follow these steps** to correct the order:
**Note: This procedure requires *cpstop; cpstart*.******

1. Run the command *cpstop*.
2. Backup the registry file:  
   *# cp $CPDIR/registry/HKLM_registry.data $CPDIR/registry/HKLM_registry.data.backup*
3. Edit the registry file and add "*DoReverseFramedIp (1)* " as shown below:  

   **Before:**   
   This line starts the header  
   version=191800  
   ! This line ends the header  
   ("CheckPoint Repository Set"  
   : (SOFTWARE  
   : (CheckPoint  
   : (CPshared  
   :CurrentVersion (6.0)  
   : (6.0  
   :CurrentLabel (R80.20)  
   :CurrentSP (4)  
   :CPDIR ("/opt/CPshrd-R80.20")  
   :PRODDIR ("/opt/CPshrd-R80.20")  
   :AutoStart (1)  
   :IsConfigured (1)  
   :ProdActive (1)  
   :FireWall-1 (2)  
   :ReportingTool (1)  
   :SecureXL (1)  
   :VersionText (R80.20)  

   **After:**   
   This line starts the header  
   version=191800  
   ! This line ends the header  
   ("CheckPoint Repository Set"  
   : (SOFTWARE  
   : (CheckPoint  
   : (CPshared  
   :CurrentVersion (6.0)  
   : (6.0  
   :CurrentLabel (R80.20)  
   :CurrentSP (4)  
   :CPDIR ("/opt/CPshrd-R80.20")  
   :PRODDIR ("/opt/CPshrd-R80.20")  
   :AutoStart (1)  
   :IsConfigured (1)  
   :ProdActive (1)  
   :FireWall-1 (2)  
   **:DoReverseFramedIp (1)**   
   :ReportingTool (1)  
   :SecureXL (1)  
   :VersionText (R80.20)
4. Run the command *cpstart*.

******Note:** If you want to keep the IP reversed, either remove the line, or set the value to "0".****

The value can also be added and set with ckp_regedit commands.  
Enable: *# ckp_regedit -a SOFTWARE/CheckPoint/CPshared/6.0 DoReverseFramedIp 1*   
Disable: *# ckp_regedit -a SOFTWARE/CheckPoint/CPshared/6.0 DoReverseFramedIp 0*

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content