> Source: [sk179745](https://support.checkpoint.com/results/sk/sk179745)

# sk179745 - Outgoing SSH/SCP connections from the Standby Cluster Member are dropped

| Property | Value |
|----------|-------|
| Solution ID | sk179745 |
| Date Created | 2022-08-01 |
| Last Modified | 2022-08-03 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Outgoing SSH/SCP connections from the Standby Cluster Member **are dropped**.
* Outgoing SSH/SCP connections from the Active Cluster Member **pass**.
* Ping (or other outgoing connections) **passes** from both members.
* "fw ctl zdebug + drop" on the Active Cluster Member shows:   
  `"fw_log_drop_ex: Packet proto=6 x.x.x.x:35054 -> x.x.x.x:22 dropped by fw_post_vm_chain_handler Reason: Handler 'ssh2_code' drop"`
* Setting "*fwha_cluster_hide_active_only* " to "0" (*fw ctl set int fwha_cluster_hide_active_only 0*) on the Standby Cluster Member solves the issue.

## Cause

An explicit rule for outgoing SSH/SCP traffic from the cluster with the service "ssh_version_2" is created. The protocol handler inspects the traffic but does not identify it as a correct SSH version 2 traffic.  

![Rule with ssh_version_2](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1658927372722/sshv2202207271526231.jpg)  

The Implicit Rule for "Accept outgoing packets originating from Gateway" may be enabled but does not hit because it is placed "Before Last" by default.  

An explicit NAT rule disables hiding behind the cluster VIP of the outgoing traffic from a cluster member. This may be a wanted behaviour or can also happen because of using a Network Object or a Network Group Object that includes specific interface IP addresses of the cluster.  

![NO-NAT for Cluster](https://sc1.checkpoint.com/sc/SolutionsStatics/sk179745/image 1202208011201282.jpg)

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content