> Source: [sk173845](https://support.checkpoint.com/results/sk/sk173845)

# sk173845 - Out of state drops for connections that are not symmetrical in Scalable Platforms (Maestro and Chassis)

| Property | Value |
|----------|-------|
| Solution ID | sk173845 |
| Date Created | 2021-06-04 |
| Last Modified | 2022-02-24 |
| Technical Level | General |
| Products | Scalable Platforms |
| Versions | R82.20, R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Out of state drops for connections that are not symmetrical in Scalable Platforms (local and non-local connections).

* Enabling correction debug -\> `fw ctl debug -m cluster + correction` shows this on the s2c packet on the non-owner member of the connection:  

  "`fwha_ccl_get_forwarding_dest_members: <[IP Address](22) -> [IP Address](34750) IPP 6> corrected statefully with bmac from another member`"

## Cause

A packet that arrives with the second bit on (00000010) in the first octet of the source MAC is mistakenly regarded as a corrected packet (examples: x**2** :x:x:x:x:x, x**6** :x:x:x:x:x.....).   

A packet cannot be corrected more than once. Consequently, the member that handles the s2c packet does not correct the packet of the connection owner.  

<br />

## Solution

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R80.20SP](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk155832) starting from Take 315

If you do not wish to upgrade, this **workaround** is available.

1. Disable `non_strict_ccl_mac_check` on all members:  
   `g_fw ctl set int non_strict_ccl_mac_check 0 -a`
2. Make sure it is disabled:  
   `g_fw ctl get int non_strict_ccl_mac_check -a`
3. Make sure it survives reboot:  
   `g_update_conf_file $PPKDIR/conf/simkern.conf non_strict_ccl_mac_check=0`

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content