> Source: [sk175113](https://support.checkpoint.com/results/sk/sk175113)

# sk175113 - Traffic latency when it passes through a Virtual Switch (VSW)

| Property | Value |
|----------|-------|
| Solution ID | sk175113 |
| Date Created | 2021-08-19 |
| Last Modified | 2024-02-04 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |

## Symptoms

- * Traffic latency when it passes through a Virtual Switch (VSW).

* Output of the "`top`" command on the VSX Gateway shows that the FWK process for the context of the Virtual Switch consumes the CPU at a high level.

* Output of the "`fw ctl get int sim_warp_jump_strict_mac -a`" command on the VSX Gateway shows that this SecureXL kernel parameter has the value 0 (zero):

  ```
  
  FW:
   Get operation failed: failed to get parameter sim_warp_jump_strict_mac
  PPAK 0: sim_warp_jump_strict_mac = 0
  ```

## Cause

The source MAC address is different from the MAC address in the ARP Reply. This causes traffic destined to other VSX cluster members to flood the bridge forwarding database in the Virtual Switch.

Example traffic flow:  
Client \<==\> Router \<==\> \[VSW \<=\> VS1\] \<==\> Server

## Solution

This problem was fixed. The fix is included starting from:

* [Check Point R81](https://support.checkpoint.com/results/sk/sk166715)

Check Point recommends to always upgrade to the most recent version ([VSX](https://support.checkpoint.com/product/359)).

### Workaround Procedure

If you choose not to upgrade, follow this workaround procedure.

Configure the value of the kernel parameter `sim_warp_jump_strict_mac` to `1`.

The kernel parameter value of "`1`" configures SecureXL to drop packets if they are sent to a MAC address that does not belong to the Virtual System / Virtual Switch that received these packets.

Follow the applicable procedure.

**To change the value of the SecureXL kernel parameter permanently (recommended - survives reboot):**

1. Connect to the command line of the VSX Gateway / each VSX Cluster Member.
2. Log in to Gaia Clish or the Expert mode.
3. Configure the value of the kernel parameter:  
   `fw ctl set -f int sim_warp_jump_strict_mac 1 -a`
4. Get the value of the kernel parameter (ignore the section "`FW:`"):  
   `fw ctl get int sim_warp_jump_strict_mac -a`
5. Reboot the VSX Gateway / each VSX Cluster Member, when possible.
6. Get the value of the kernel parameter (ignore the section "`FW:`"):  
   `fw ctl get int sim_warp_jump_strict_mac -a`

**To change the value of the SecureXL kernel parameter temporarily (does not survive reboot):**   

1. Connect to the command line of the VSX Gateway / each VSX Cluster Member.
2. Log in to Gaia Clish or the Expert mode.
3. Configure the value of the kernel parameter:  
   `fw ctl set int sim_warp_jump_strict_mac 1 -a`
4. Get the value of the kernel parameter (ignore the section "`FW:`"):  
   `fw ctl get int sim_warp_jump_strict_mac -a`

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content