> Source: [sk171146](https://support.checkpoint.com/results/sk/sk171146)

# sk171146 - Drop Templates are generated for connections that match rules with the "Reject" action, instead of rejecting the connection

| Property | Value |
|----------|-------|
| Solution ID | sk171146 |
| Date Created | 2020-12-22 |
| Last Modified | 2023-03-02 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81 (EOS) |
| OS | Gaia |

## Symptoms

- Drop Template is generated for connections that match rules with the "Reject" action, instead of rejecting the connection.

## Cause

SecureXL handles Drop Templates. SecureXL does not support the Firewall action "Reject". As a result, SecureXL creates a Drop Template.

## Solution

This problem was fixed. The fix is included in:

* [Check Point R81.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170416)
* [Jumbo Hotfix Accumulator for R81](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170114) starting from Take 13
* [Jumbo Hotfix Accumulator for R80.40](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456) starting from Take 100
* [Jumbo Hotfix Accumulator for R80.30](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk153152) starting from Take 228
* [Jumbo Hotfix Accumulator for R80.20](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592) starting from Take 190
* [Jumbo Hotfix Accumulator for R80.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk116380) starting from Take 290

**Hotfix installation instructions:**

Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).

<br />

**Solution description:**

A new kernel parameter was added on the Security Gateway to control this behavior - ***offload_drop_template_for_reject***.

Supported values for this kernel parameter:

* **1** - Firewall **offloads** a drop template, even if the matched action is "Reject".   
  **Note -** This is the default value. This value is recommended for best performance.
* **0** - Firewall **does not**offload a drop template, if the matched action is "Reject".

**Notes:**

1. To get the current parameter value, run on the Security Gateway / each Cluster Member:

   **`fw ctl get int offload_drop_template_for_reject`**
2. To configure the parameter value in the current session (does not survive reboot), run on the Security Gateway / each Cluster Member:

   **`fw ctl set int offload_drop_template_for_reject {0 | 1}`**
3. To configure the parameter value permanently (survives reboot), run on the Security Gateway / each Cluster Member:

   **`fw ctl set -f int offload_drop_template_for_reject {0 | 1}`**

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content