> Source: [sk174234](https://support.checkpoint.com/results/sk/sk174234)

# sk174234 - Scalable Platform drops traffic as "Out of State" when static NAT is configured for the destination IP Address

| Property | Value |
|----------|-------|
| Solution ID | sk174234 |
| Date Created | 2021-07-01 |
| Last Modified | 2023-03-18 |
| Technical Level | Advanced |
| Products | Scalable Platforms |
| Versions | R81.10 (EOS), R81 (EOS) |
| OS | Gaia |
| Platform | 15000, 5000, 7000, 28000, 41000 (EOL), 44000, 64000, 26000, 6000 |

## Symptoms

- Scalable Platform drops traffic as "Out of State" when static NAT is configured for the destination IP Address:

Client ---\> Security Group (hides the Client IP address behind Static NAT) ---\> Server

## Cause

Chain of events:

1. One of the Security Group Members receives the connection and inspects it.
2. The Security Group Member synchronizes the connection information to all other Security Group Members.
3. Because the delayed sync is enabled in the Security Group (this is the default), the connection's timeout is not updated on other Security Group Members.
4. At some later point, one of these other Security Group Members synchronizes its connection information with the old timeout to all other Security Group Members.
5. The connection timeout is decreased as if this connection was idle for a short period.
6. As a result, the connection packets are treated as part of a closed connection and are dropped as "out of state".

<br />

To make sure this is the issue in your Security Group, you can run this debug (see the [R81.10 Security Gateway Administration Guide](https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_Quantum_SecurityGateway_Guide/Default.htm) \> Chapter *Kernel Debug*):

**Important Note** - Debug causes higher load on the CPU.

**`g_fw ctl zdebug + conn nat xlate xltrc`**

During the described issue, the debug shows this flow:

1. The connection opens, and one of the Security Group Member receives it for inspection.
2. The Security Group Member that received this connection synchronizes its information to other Security Group Members with a TCP start timeout.
3. The Security Group Member that received this connection updates the connection timeout value.
4. One of the other Security Group Members synchronizes its connection information to other Security Group Members with the original TCP start timeout.

For more information about the delayed sync, see the [R81.10 Maestro Administration Guide](https://sc1.checkpoint.com/documents/R81.10/WebAdminGuides/EN/CP_R81.10_Maestro_AdminGuide/Default.htm) \> Chapter *System Optimization* \> Section *Configuring Services to Synchronize After a Delay*.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content