> Source: [sk179750](https://support.checkpoint.com/results/sk/sk179750)

# sk179750 - "Drop" and "Reject" connections in sam_alert script

| Property | Value |
|----------|-------|
| Solution ID | sk179750 |
| Date Created | 2022-08-01 |
| Last Modified | 2023-01-24 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.10 (EOS), R81 (EOS) |

## Symptoms

- When changing from SAM v2 to SAM v1 and replacing the "SAM v2" script with the "SAM v1" script, SAM rules are no longer applied to the Security Gateway.

## Cause

Previously:  
The *sam_alert* script used the action "Reject" for SAMv1, when connection is closed entirely and the IP is blocked.  
The *sam_alert* script used the action "Drop" and "Reject" for SAMv2, when connection continues transmitting packets and the malicious connection is closed or closed entirely.  

Therefore, "SAM v2" script and the "SAM v1" script were not identical. Replacing one script with another caused some SAM rules to be no longer active for the Security Gateway.

## Solution

To unify the list of actions for smooth transition between scripts, you can install a Hotfix which provides necessary modifications.
[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.  

In *sam_alert v1* there are now two options:   

* The "-j" (lower case) option allows to drop the packet and let the connection continue transmitting packets.
* The "-J" (upper case) option allows to drop the packet and stop (block) the connection.

<br />

![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1659064619427/Alerts202207291251192.png)  

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content