> Source: [sk168172](https://support.checkpoint.com/results/sk/sk168172)

# sk168172 - VPN traffic is not forwarded to tunnel owner and being dropped for "Possible TCP state violation"

| Property | Value |
|----------|-------|
| Solution ID | sk168172 |
| Date Created | 2020-07-22 |
| Last Modified | 2020-09-01 |
| Technical Level | Advanced |
| Products | Scalable Platforms |
| Versions | R82.20, R82.10, R82, R81.20 |

## Symptoms

- * SYN packet was not forwarded to the tunnel owner and was encrypted by wrong SGM.
* Server reply packets (SYN_ACK) are dropped by the tunnel owner for "Possible TCP state violation"
* The source MAC address of the clear packet starts with "02".  
  For example: "02:1a:2b:3c:4d:5e"
* *dxl calc* and *tcpdump* show that the VPN packets are being encrypted by an SGM which is **++not++** the tunnel owner

## Cause

**Scenario:**  
Internal client machine submits a SYN packet for a new connection.  
The SYN packet arrives to SGM1 in the Maestro cluster. For the specific peer of this VPN tunnel, the tunnel owner is SGM2.  
SGM1 should forward the packet to SGM2 for encryption, but this does not happen. SGM1 completes IKE negotiation and encrypts the packet.  
The server in the remote site sends a reply (SYN-ACK) packet. The encrypted SYN-ACK arrives on SGM2.  
SGM2 has no knowledge of this connection, so the packet is dropped for out of state after decryption.  

Because the source MAC address starts with "02", the system mistakenly decides this packet was already internally forwarded by another SGM.   

Double-forwarding is not allowed, so the SGM who received the packet must handle it.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content