> Source: [sk170360](https://support.checkpoint.com/results/sk/sk170360)

# sk170360 - Inspect function failure after upgrade of Security Gateway causes cleanup rule to drop traffic that should have been accepted 

| Property | Value |
|----------|-------|
| Solution ID | sk170360 |
| Date Created | 2020-11-06 |
| Last Modified | 2020-11-09 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Traffic that should have been accepted is dropped by the cleanup rule after an upgrade of the Security Gateway.
* Basic `conn vm drop` kernel debug shows the following reason for traffic drops:   
  `dropped by fw_runfilter_ex Reason: function does not exist`.   
  **Note**: The issue occurs only when the user upgrades the Security Gateway to the same major release version of the Security Management Server and does not occur after rollback to the previous version.
* *fwk.elg* logs show the following messages:   
  `[ERROR]: up_fw_load_inspect_func_ids: failed to get inspect function RECORD_CONN id`

  <br />

## Cause

Packets fail to enter inspect due to a policy corruption caused by a misconfiguration of the *table.def* file. In most cases, this is simply is a syntax error such as a missing bracket, comma, or semicolon.   

**Note:** The reason this does not impact the previous version but does impact the upgraded version is that the *table.def* locations on the Security Management Server vary depending on the version of the Security Management Server vs. the version of the Security Gateway. These are two different files in different locations.

**Example**:

R77.30 Security Gateway: *the table.def* on an R80.40 Security Management Server is in the */opt/CPR77CMP-R80\*/lib* folders.

vs.

R80.40 Security Gateway: the *table.def* on an R80.40 Security Management Server is in the *$FWDIR/lib/* folder.

<br />

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content