> Source: [sk181250](https://support.checkpoint.com/results/sk/sk181250)

# sk181250 - HCP report shows "Jumbo Frame Error" when SecureXL works in the User Space (UPPAK) mode

| Property | Value |
|----------|-------|
| Solution ID | sk181250 |
| Date Created | 2023-07-14 |
| Last Modified | 2025-01-20 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |
| Platform | LightSpeed QLS, 19000, 29000 |

## Symptoms

- HCP report ([sk171436](https://support.checkpoint.com/results/sk/sk171436)) shows "Jumbo Frame Error" when SecureXL works in the User Space (UPPAK) mode.

## Cause

In the [R81.20 Jumbo Hotfix Accumulator](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) (Take 38) Check Point added support for the SecureXL User Space (UPPAK) mode operation on specific Check Point appliances. The SecureXL UPPAK mode increases performance and unlocks more advanced features in SecureXL.

When SecureXL works in the User Space (UPPAK) mode (see the [LightSpeed 10/25/40/100G QSFP28 Ports Administration Guide](https://sc1.checkpoint.com/documents/Appliances/100G_Ports_AdminGuide/Default.htm) \> section "Configuring SecureXL"), and the incoming traffic contains Jumbo Frames, the Slow Path (non-accelerated) traffic is limited to the MTU of 2002 bytes:

* If Slow Path packets are larger than 2002 bytes and do not have the IP "`Don't Fragment`" bit set, then SecureXL will fragment them.  
  To simulate such traffic, send a large ping without the "DF" bit through the Security Gateway. For example, use this command: `ping -M dont -s 8192 <IPv4 Address>`
* If Slow Path packets are larger than 2002 bytes and have the IP "`Don't Fragment`" bit set, then SecureXL will drop then and will send the ICMP Error "`Fragmentation needed and DF set`" to the source.  
  To simulate such traffic, send a large ping through the Security Gateway. For example, use this command: `ping -s 8192 <IPv4 Address>`

The Security Gateway boots and starts SecureXL in the UPPAK mode, it examines the configuration to determine if a Jumbo MTU is configured on interfaces. If the Security Gateway detects a Jumbo MTU, then it automatically enables a mitigation for the Slow Path MTU limitation.

The HCP test for Jumbo Frames was developed to check for both the SecureXL UPPAK mode and Jumbo MTU enabled.

The Security Gateway will not pass this HCP test pass if the mitigation for the Slow Path MTU limitation is disabled. This scenario is possible if an administrator configured a Jumbo MTU on an interface, but did not reboot the Security Gateway yet.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content