> Source: [sk172284](https://support.checkpoint.com/results/sk/sk172284) # sk172284 - Threat Emulation Identifies a File as Benign But Does Not Download It | Property | Value | |----------|-------| | Solution ID | sk172284 | | Date Created | 2021-02-28 | | Last Modified | 2021-08-20 | | Technical Level | General | | Products | Security Gateway | | Versions | R82.10, R82, R81.20 | ## Symptoms - * When Threat Emulation downloads a file, the download does not start and this error message shows in the browser: ` "Failed - Network error", when retrying to download, the download will succeed. ` * The Threat Emulation blade shows that the verdict is benign. * Disabling Strict Hold resolves the issue. * tcpdump shows that the client sends an RST packet and closes the connection. It can happen when we hold the file for too long. * Fiddler shows: ` HTTP/1.1 504 Fiddler - Receive Failure is seen. GET https://metageek-desktop.nyc3.digitaloceanspaces.com/Installers/inSSIDerLitePlus/123.exe 504 Fiddler - Receive Failure (text/html) ` ## Cause The connection was rejected due to an issue in the TLS flow. Threat Emulation and HTTPS inspection are enabled. Traffic is stuck even though cmi was asked to transfer it. The issue only happens with HTTPS enabled. When transferring the same file on HTTP, it is transferred appropriately. Kernel: The connection is closed in the middle of writing and this TLS error message shows: *@;317071414;\[cpu_1\];\[fw4_2\];tls_main_handle_connect_method: continueing with tls main flow due to TLS_MUX_READ_START;* *@;317071414;\[cpu_1\];\[fw4_2\];tls_main_handle_ingress: called.;* *@;317071414;\[cpu_3\];\[fw4_0\]; 32: be de 00 01 50 e4 00 68 00 c8 0c ce c1 04 00 00 ....P..h........;* *@;317071414;\[cpu_1\];\[fw4_2\];mux_stream_iterator_init_from_offset: Found bucket: bucket=ffffc9002e373df8, bucket-offset=2173,len=31, iterated=1, is_last=1, from_end=0, caller=mux_stream_to_buf;* *@;317071414;\[cpu_1\];\[fw4_2\];tls_main_handle_ingress: header:;* *@;317071414;\[cpu_1\];\[fw4_2\]; 0: \<15 03 03 00 1a\> .....;* *@;317071414;\[cpu_1\];\[fw4_2\];;* *@;317071414;\[cpu_3\];\[fw4_0\]; 48: 00 00 00 00 00 00 00 00 df 19 23 62 7d 9d a7 0d ..........#b}...;* *@;317071414;\[cpu_1\];\[fw4_2\];**tls_main_handle_ingress: content type: CPTLS_alert (21)**, version: 0x0303, size: 26;* *@;317071414;\[cpu_1\];\[fw4_2\];mux_stream_iterator_init_from_offset: Found bucket: bucket=ffffc9002e373df8, bucket-offset=2173,len=31, iterated=1, is_last=1, from_end=0, caller=mux_stream_to_buf;* *@;317071414;\[cpu_1\];\[fw4_2\];mux_stream_delete_data: rem_to_del=31.;* *@;317071414;\[cpu_1\];\[fw4_2\];mux_stream_delete_data: Deleting a whole bucket.;* *@;317071414;\[cpu_1\];\[fw4_2\];mux_stream_remove_buf: Removing buffer. mux_buf=ffffc9001cd495e0, len=31, removed_bytes=31.;* *@;317071414;\[cpu_3\];\[fw4_0\]; 64: af c6 fc bc 10 ca 2d b9 0c 7b e7 54 c6 9f ee 8d ......-..{.T....;* *@;317071414;\[cpu_1\];\[fw4_2\]* ***;t\*ls_main_handle_ingress: fatal alert. description: CPTLS_bad_record_mac (20);\**** ## Solution [This problem was fixed. The fix is included starting in:](https://www.checkpoint.com/support-services/contact-support/) * [**R80.40 T119**](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456&partition=Basic&product=All) Check Point recommends to always upgrade to the most recent version. **For all other versions:** [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/)to get a Hotfix for this issue. A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix. For faster resolution and verification please collect [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) files from the Security Management and Security Gateways involved in the case. **Hotfix installation instructions:** Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597). --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content