> Source: [sk172942](https://support.checkpoint.com/results/sk/sk172942)

# sk172942 - Connections through a VPN tunnel with a Maestro Security Group are very slow

| Property | Value |
|----------|-------|
| Solution ID | sk172942 |
| Date Created | 2021-05-17 |
| Last Modified | 2021-05-19 |
| Technical Level | General |
| Products | Scalable Platforms |
| Versions | R82.20, R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Connections through a VPN tunnel with a Maestro Security Group are very slow.

* Output of the ping command shows that about 10% of the packets are lost on the route through the VPN tunnel.

* Kernel debug on the other VPN peer (regular Check Point Security Gateway) shows that it drops the traffic because of a 'Replay Attack' and Stateful Inspection.

## Cause

ICMP Type 11 packets hold the original connection in the inner IP and TCP headers, and not in the outer IP header.

The affected Maestro Security Group mistakenly examines the IP addresses in the outer header instead of the inner header to determine whether it must encrypt these ICMP Type 11 packets.

As a result, the traffic inside the Maestro Security Group is forwarded to a wrong Maestro Security Group Member.

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification please collect CPinfo files from the Security Management and Security Gateways involved in the case.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content