> Source: [sk169495](https://support.checkpoint.com/results/sk/sk169495)

# sk169495 - SecureXL keeps forwarding packets in VSX bridge mode when the member is down

| Property | Value |
|----------|-------|
| Solution ID | sk169495 |
| Date Created | 2020-09-23 |
| Last Modified | 2024-02-06 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * SecureXL keeps forwarding traffic on VSX Cluster in bridge mode, even though the member is down.

* Running the 'ClusterXL_admin down' command switches in between the cluster level, but not falling over the traffic.

* Running cpstop and turning off interface works correctly and the traffic failover as it should.

* The VSX Cluster is only passing through BGP traffic.

## Cause

The cluster member still forwards BFDv1 (Bidirectional Forwarding Detection) packets, and this leads to the fact, that BFDv1 is not triggering the BGP Routing to prioritize the second Path via cluster member 2, which cause a slow failover of the BGP routing and the loss of connections.

## Solution

This problem was fixed (requires manual configuration). The fix is included stating from:

* [Jumbo Hotfix Accumulator for R81](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170114) starting from Take 42
* [Jumbo Hotfix Accumulator for R80.40](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456) starting from Take 119
* [Jumbo Hotfix Accumulator for R80.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk153152) starting from Take 237

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

<br />

**Procedure to prevent a VSX Cluster Member in the "Down" state from forwarding accelerated traffic:**

1. Install the Jumbo Hotfix Accumulator / Hotfix on all cluster members.

   Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).
2. Connect to the command line on each VSX Cluster Member.

3. Log in to the Expert mode.

4. Configure the value of the kernel parameter **fwha_drop_pckt_on_down_member** to 1 on each VSX Cluster Member:

   1. In the current session:

      `fw ctl set int fwha_drop_pckt_on_down_member 1 -a`  

      `Note - following output is expected:`  
      `PPAK 0: Get before set operation succeeded of fwha_drop_pckt_on_down_member`  
      ` kiss_params: failed to update VS 0`

      `fw ctl get int fwha_drop_pckt_on_down_member -a`
   2. Permanently:

      `fw ctl set -f int fwha_drop_pckt_on_down_member 1 -a`  

      `Note - following output is expected:`  
      `PPAK 0: Get before set operation succeeded of fwha_drop_pckt_on_down_member`  
      ` kiss_params: failed to update VS 0`  
      `"fwkern.conf" was updated successfully`

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content