> Source: [sk172904](https://support.checkpoint.com/results/sk/sk172904) # sk172904 - "simi_reorder_enqueue_packet: reached the limit of maximum enqueued packets, app: Route" error message in dmesg | Property | Value | |----------|-------| | Solution ID | sk172904 | | Date Created | 2021-04-05 | | Last Modified | 2022-01-10 | | Technical Level | General | | Products | Security Gateway | | Versions | R81 (EOS) | | OS | Gaia | ## Symptoms - * The following error appears in the output of the "`dmesg`" command: ` simi_reorder_enqueue_packet: reached the limit of maximum enqueued packets! conn:, fw_key:, `**app: Route** Note the "**`app: Route`** " at the end of the error message. This shows that the message was generated by the "`reorder`" infrastructure for the "`Route`" application, and not by an unrelated app. * The following error appears in the output of the "`dmesg`" command: `resume_from_error: failed to get ci_or_corr` * Traffic does not pass through the Security Gateway at the time of these messages appear. ## Cause SecureXL is configured to use the flow where the value of the SecureXL kernel parameter "`run_with_hold`" is set to 1. When SecureXL encounters an unresolved next-hop error, it uses this queueing mechanism to hold the real data packets while resolving the ARP. ## Solution This problem was fixed. The fix is included in: * [Check Point R81.10](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170416) * [R81 Jumbo Hotfix Accumulator](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk170114) - starting in Take 34 * [R80.40 Jumbo Hotfix Accumulator](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk165456) - starting in Take 119 * [R80.30 Jumbo Hotfix Accumulator](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk153152#Availability) - starting in Take 237 * [R80.20 Jumbo Hotfix Accumulator](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk137592) - starting in Take 202 Check Point recommends to always upgrade to the most recent version ([upgrade Security Gateway](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=435) / [upgrade Security Management Server](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=184) / [upgrade Multi-Domain Security Management](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=overview&product=166)).
Workaround ---------- If you choose not to upgrade, configure SecureXL to use the the flow where "run_with_hold" is set to 0. In the older flow, when SecureXL encounters an unresolved next-hop error, it does not hold the real data packets while resolving the ARP. **Note** - Schedule a full maintenance window. #### Procedure for Security Gateway / Cluster Members Show / Hide this section 1. Connect to the command line on the Security Gateway / each Cluster Member. 2. Log in to the Expert mode. 3. Configure the value 0 for the SecureXL kernel parameter "`run_with_hold`" in the current session (does not survive a reboot): `fw ctl set int run_with_hold 0 -a` **Important Note** - Pay attention only to the lines that start with "**PPAK**". Failure to change the value of this parameter in the Security Gateway kernel is expected because it does not contain this kernel parameter. 4. Examine the value of the SecureXL kernel parameter "`run_with_hold`" in the current session: `fw ctl get int run_with_hold -a` **Important Note** - Pay attention only to the lines that start with "**PPAK**". Failure to get the value of this parameter from the Security Gateway kernel is expected because it does not contain this kernel parameter. 5. Configure the value 0 for the SecureXL kernel parameter "`run_with_hold`" in the *$PPKDIR/conf/simkern.conf* file (for the change to survive a reboot): 1. Edit the *$PPKDIR/conf/simkern.conf* file: `vi $PPKDIR/conf/simkern.conf` 2. Add this line (spaces and comments are not allowed): `run_with_hold=0` 3. Save the changes in the file and exit Vi editor.
#### Procedure for Scalable Platforms Show / Hide this section 1. Connect to the command line on the Security Group. 2. Log in to the Expert mode. 3. Configure the value 0 for the SecureXL kernel parameter "`run_with_hold`" in the current session (does not survive a reboot): `g_fw ctl set int run_with_hold 0 -a` **Important Note** - Pay attention only to the lines that start with "**PPAK**". Failure to change the value of this parameter in the Security Gateway kernel is expected because it does not contain this kernel parameter. 4. Examine the value of the SecureXL kernel parameter "`run_with_hold`" in the current session: `g_fw ctl get int run_with_hold -a` **Important Note** - Pay attention only to the lines that start with "**PPAK**". Failure to get the value of this parameter from the Security Gateway kernel is expected because it does not contain this kernel parameter. 5. Configure the value 0 for the SecureXL kernel parameter "`run_with_hold`" in the *$PPKDIR/conf/simkern.conf* file (for the change to survive a reboot): `g_update_conf_file $PPKDIR/conf/simkern.conf run_with_hold=0` **Note** - This command makes the required change on all Security Group Members.
--- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content