> Source: [sk180286](https://support.checkpoint.com/results/sk/sk180286)

# sk180286 - Cannot connect from one Security Gateway (SGM) to a different SGM in the same Security Group through SSH

| Property | Value |
|----------|-------|
| Solution ID | sk180286 |
| Date Created | 2023-01-03 |
| Last Modified | 2023-01-05 |
| Technical Level | General |
| Products | Scalable Platforms |
| Versions | R81.10 (EOS) |

## Symptoms

- * You cannot connect from one SGM to a different SGM in the same Security Group through SSH.  

  ```
  [Expert@SecurityGroup1-ch01-01:0]# m 2
  Moving to member 1_2
  
  [Expert@SecurityGroup1-ch01-01:0]# telnet 192.0.2.2 22
  Trying 192.0.2.2...
  ```

  <br />

* Running the "`# fw ctl zdebug + drop`" command on the target SGM shows that the SecureXL DROP template drops the connection.  

  ```
  @;2962875545;[kern];[tid_49];[SIM-240796742];sim_pkt_send_drop_notification: sending single drop notification, conn: <192.0.2.1,33630,192.0.2.2,22,6>;
  @;2962875547;[kern];[tid_49];[fw4_0];fw_log_drop_ex: Packet proto=6 192.0.2.1:33630 -> 192.0.2.2:22 dropped by fwmultik_handle_no_match Reason: 
  Drop template rule id 6 (inbound);
  ```

  <br />

* The SGMs are reachable from the Maestro Hyperscale Orchestrators (MHOs), and traffic processing operates correctly on all SGMs. <br />

## Cause

This is a rare issue in which the internal SYNC network (192.0.2.0/24) is included in the SecureXL DROP template, causing the block.  

`[Expert@SecurityGroup1-ch01-02:0]# fwaccel templates -d`  
`Source Range SPort Range Destination Range IPP,DPort Range Rule No. Flags`  

`175.44.121.64 - 172.20.32.0 - 2 , 0- < 0,6> D.*`  
`192.168.67.87 192.168.67.87 6 ,18189`  

<br />

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification please collect [CPinfo](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92739) files from the Security Management and Security Gateways involved in the case.  

**Note:** Install the Hotfix on the Security Management Server **and** the SGMs.  

**Hotfix installation instructions:**   
[Refer to sk168597 - How to install a Hotfix.](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597)  

As a **workaround** ,create an access rule to allow communication between the internal SYNC network (192.0.2.0/24) explicitly.  

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content