> Source: [sk172665](https://support.checkpoint.com/results/sk/sk172665)

# sk172665 - ARP packet is dropped with: "fwha_process_incoming_arp Reason: illegal IF number"

| Property | Value |
|----------|-------|
| Solution ID | sk172665 |
| Date Created | 2021-06-03 |
| Last Modified | 2021-06-08 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Running kernel debug ('fw ctl zdebug + drop'), an ARP packet drop log is seen:   

  `fw_log_drop_ex: Packet proto=-1 ?:0 -> ?:0 dropped by fwha_process_incoming_arp Reason: illegal IF number;`

* In some cases this drop is also seen:   

  `fw_log_drop_ex: Packet proto=-1 ?:0 -> ?:0 dropped by fwha_select_arp_packet Reason: CPHA replies to arp;`

* one or more interfaces are in state off and although the interface is in a state off the Security Gateway still holds the routes related to that interface.

* Deleting the interface resolves the issue.

## Cause

The ARP is dropped as it has reached on a "non existing interface".

The interface is in a state off but is still configured as an agent interface even due it is in a state off, for example:
`[Expert@GW]# cat /config/active | grep eth2.2070`  
`interface:eth2.2070 t`  
`interface:eth2.2070:state off`  
`interface:eth2.2070:ipaddr:10.20.70.2 t`  
`interface:eth2.2070:ipaddr:10.20.70.2:mask 24`  

`[Expert@GW]# cat /config/active | grep bind_if:eth2.2070`  
`snmp:bind_if:eth2.2070 t`

<br />

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content