> Source: [sk179822](https://support.checkpoint.com/results/sk/sk179822)

# sk179822 - Security Gateway in Bridge mode drops traffic with the "Virt Defrag Timeout" message

| Property | Value |
|----------|-------|
| Solution ID | sk179822 |
| Date Created | 2022-08-28 |
| Last Modified | 2024-11-10 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Security Gateway that is configured in bridge active / active mode, or with many bridge interfaces, does not pass traffic through the bridge interfaces.

* Kernel debug on the Security Gateway / cluster members shows:

  `
  ;[SIM-207100061];sim_pkt_send_drop_notification: sending packet dropped notification drop mode: 0 debug mode: 1 send as is: 0 track_lvl: -1, conn: `;  
  ;[SIM-207100061];sim_pkt_send_drop_notification: sending single drop notification, conn: ;  
  ;cphwd_notif_packet_dropped: recieved packet dropped notification, reason: Virt Defrag Timeout;  
  ;cphwd_notif_packet_dropped: notification holds a single drop;

## Cause

The issue happens with any type of traffic that is fragmented and split over two bridge interfaces.

Because the Security Gateway receives fragments of the same packet from two different interfaces, the Security Gateway cannot assemble the fragments to inspect the complete packet.

Because the Security Gateway never completes the inspection of the packet, it drops the fragments after their timeout expires.

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, collect [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) files from the Management Server and Security Gateways / Cluster Members involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).

<br />

**After you install the hotfix on the Security Gateway / cluster members:**

1. Connect to the command line on the Security Gateway / each cluster member.

2. Log in to Expert mode.

3. Configure the value "1" (one) for the required firewall kernel parameters:

   1. Back up the current configuration file:

      `[expert@hostname:0]# cp -v $FWDIR/boot/modules/fwkern.conf{,_BKP}`
   2. Edit the current configuration file:

      `[expert@hostname:0]# vi $FWDIR/boot/modules/fwkern.conf`
   3. Add these lines anywhere in the file:

      `bridge_route_fragments=1`

      `frag_ignore_ifn=1`

      `frag_timeout_override=<VALUE in SECONDS>`

      **Note** - The parameter "`frag_timeout_override`" is optional.
   4. Save the changes in the file and exit Vi editor.

4. Configure the value "1" (one) for the required SecureXL kernel parameters:

   1. Back up the current configuration file:

      `[expert@hostname:0]# cp -v $PPKDIR/conf/simkern.conf{,_BKP}`
   2. Edit the current configuration file:

      `[expert@hostname:0]# vi $PPKDIR/conf/simkern.conf`
   3. Add these lines anywhere in the file:

      `bridge_route_fragments=1`

      `frag_ignore_ifn=1`

      `frag_timeout_override=<VALUE in SECONDS>`

      **Note** - The parameter "`frag_timeout_override`" is optional.
   4. Save the changes in the file and exit Vi editor.

5. Reboot the Security Gateway / each cluster member.

**Description of kernel parameters:**

|--------------------------|-----------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------|
| Kernel Parameter         | Description                                                                       | Notes                                                                                        |
| `bridge_route_fragments` | Controls the hotfix.                                                              | Mandatory. * 0 - disables the hotfix * 1 - enables the hotfix                                |
| `frag_ignore_ifn`        | Controls whether to ignore the incoming interface when handling packet fragments. | Mandatory. * 0 - does not ignore the incoming interface * 1 - ignores the incoming interface |
| `frag_timeout_override`  | Controls the timeout for packet fragments.                                        | Optional. Enter the desired value in seconds. For example, 120.                              |

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content