> Source: [sk17827](https://support.checkpoint.com/results/sk/sk17827)

# sk17827 - Allowing ICMP Redirect packets through the Security Gateway

| Property | Value |
|----------|-------|
| Solution ID | sk17827 |
| Date Created | 2003-02-12 |
| Last Modified | 2023-03-26 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Windows, Linux |

## Symptoms

- * ICMP Redirect packets are being dropped by the Security Gateway  

* Kernel debug (`fw ctl debug -m fw + drop`) shows:  
  `fw_log_drop: Packet proto=1 `*SOURCE*` -> `*DESTINATION*` dropped by fw_icmp_stateless_checks Reason: ICMP redirect packets are not allowed`

## Solution

This problem was fixed. The fix is included in the following releases:

* **NG FP3 HFA_306**
* **NG AI R55 HFA_10**
* **NGX R60**

The code was improved - a new global kernel parameter was added to control this behavior called '**fw_icmp_redirects**' :

* To allow ICMP Redirect packets through the Security Gateway, set the value of kernel parameter '**fw_icmp_redirects** ' to **1** (one)
* To drop ICMP Redirect packets on the Security Gateway (default behavior), set the value of kernel parameter '**fw_icmp_redirects** ' to **0** (zero) (default value)

1. To set the value of kernel parameter on-the-fly, run this command:
   * to allow ICMP Redirect packets  
     `# fw ctl set int fw_icmp_redirects 1`
   * to drop ICMP Redirect packets  
     `# fw ctl set int fw_icmp_redirects 0`
2. To set the value of kernel parameter permanently, refer to [sk26202](primus://skcenter.checkpoint.comsk26202).

*** ** * ** ***

If working with ClusterXL, and ICMP Redirect packets are received from a member's physical IP address instead of Cluster VIP, then check if existing NAT Rules for the Source interfere:

* Check NAT Rulebase
* If VPN is involved, then go to VPN Community - Properties - Advanced Settings - Advanced VPN Properties - this box should be checked - "Disable NAT inside the VPN community" (this option for disabling NAT applies to Hide NAT only, not Static NAT)

*** ** * ** ***

In order to see if existing NAT Rules for the Source interfere, run the following kernel debug:

```
# fw ctl debug 0
# fw ctl set int fwx_do_nat_cache 0
# fw ctl debug -buf 32000
# fw ctl debug -m fw + conn xlate nat
# fw ctl kdebug -T -f 1>> /var/log/debug.txt 2>> /var/log/debug.txt
Replicate the issue
# fw ctl debug 0
# fw ctl set int fwx_do_nat_cache 1
```

If existing NAT Rules for the Source indeed interfere, then debug will show:

```
fw_xlate_match: conn=<SourceIP:SourcePort -> DestIP:DestPort IPP ProtoNumber>; 
fw_xlate_match_epilog: There is already NAT on src/sport
fw_xlate_match: connection matches rule:
```

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content