> Source: [sk169113](https://support.checkpoint.com/results/sk/sk169113)

# sk169113 - Packet is routed through a wrong interface when ISP redundancy and SecureXL are enabled

| Property | Value |
|----------|-------|
| Solution ID | sk169113 |
| Date Created | 2020-09-03 |
| Last Modified | 2021-04-30 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * When SecureXL and ISP redundancy are enabled, the link switched to the backup line, even if the primary link was up and without issues.

* When SecureXL is disabled, the issue does not occur.

* Packets are dropped on TCP out of state:  
  `
  fw_handle_first_packet: first packet state violation (action=DROP)`

* Running kernel debug (fw ctl debug -m fw + vm conn drop misp ; fwaccel dbg + all) shows:  

  `
  @;182091907;[cpu_3];[fw4_1];fwconn_key_lookup_ex: conn <dir 0, x.x.x.x:55882 -> y.y.y.y:443 IPP 6> not found in connections table.;`  
  `
  @;182091907;[cpu_3];[fw4_1];FW-1: fw_log_tcp_out_of_state: reason First packet isn't SYN. th_flags 0x19;`  
  `
  @;182091907;[cpu_3];[fw4_1];fw_first_packet_state_checks: Dropping out of state TCP packet;`  
  `
  @;182091907;[cpu_3];[fw4_1];fw_first_packet_state_checks: chain->dir=0, dir=0, th_flags=0x19, src=y.y.y.y, dst=x.x.x.x;`  
  `
  @;182091907;[cpu_3];[fw4_1];fw_log_drop_ex: Packet proto=6 y.y.y.y:443 -> x.x.x.x:55882 dropped by fw_first_packet_state_checks Reason: First packet isn't SYN;`  
  `
  @;182091907;[cpu_3];[fw4_1];fw_handle_first_packet: first packet state violation (action=DROP);`  
  `
  @;182091907;[cpu_3];[fw4_1];fw_try_to_match_template: handle_first_packet returned action DROP for new conn=<dir 0, y.y.y.y:443 -> x.x.x.x:55882 IPP 6>;`  
  `
  @;182091907;[cpu_3];[fw4_1];fw_filter_chain: Final switch, action=DROP;`

* Kernel debug (fw ctl debug -m fw + route multik conn vm drop) shows:  

  `
  @;8184;[DATE TIME];[cpu_2];[fw4_1];skbuff_packet_update_route: replaced eth<X> with eth<X>;`  
  `
  @;8184;[DATE TIME];[cpu_2];[fw4_1];skbuff_packet_update_route: Only setting next-hop to X.X.X.X and letting kernel do the rest;
  `

* Gateway using R80.40, or R80.30 Kernel 3.10

## Cause

The issue is once a VPN packet starts the routing table is being overwritten and from there onward the routing table is returning incorrect decisions.

## Solution

This problem was fixed. The fix is included in:

* [**R81**](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk166715&partition=Basic&product=All)
* [**Jumbo Hotfix Accumulator for R80.40 starting from Take 83**](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456)
* **[Jumbo Hotfix Accumulator for R80.30 starting from Take 219](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk153152)**

Check Point recommends to always upgrade to the most recent version.  

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content