> Source: [sk181354](https://support.checkpoint.com/results/sk/sk181354)

# sk181354 - Security Gateway deletes the PIM OIF after it sends "Prune-Echo" and enters MRT

| Property | Value |
|----------|-------|
| Solution ID | sk181354 |
| Date Created | 2023-08-08 |
| Last Modified | 2025-01-20 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Traffic outage on the Security Gateway for the traffic that relies on multicast.

* The output of the "`ip mroute`" command on the Security Gateway shows that the "`Oif`" disappears (deleted until another PIM Join is sent for the same "(S,G)") and recovers with different intervals of time needed to recover.

* PIM Debug shows that the Security Gateway goes to MRT and then then it deletes the OIF.

  Example lines from the */var/log/routed.log* file:

  `
  task_timer_dispatch: calling PIM_PIM_SM_MRT_MAINTENANCE, late by 0:00.000`  
  `
  <DATE TIME> mfc_del_oif: deleting oif <Interface> > from (<GROUP IP>, <SOURCE IP>)/64`  
  `
  <DATE TIME> mfc_krt: parent IF <Interface>`  
  `
  <DATE TIME> mfc_krt: nexthop IF <Interface>
  `

## Cause

Incorrect state transition when the Prune Pending Timer expires.

The (S,G) entry on SPT or the (\*,G) entry should transition to the "NoInfo" state while the (S,G) entry on RPT should transition to the "Prune" state.

The logic before was that the (S,G) entry on SPT would transition to the "Prune" state, which led to other incorrect state transitions when receiving a "Join".

Example scenario when the issue can occur:

1. There are multiple downstream PIM neighbors on the same LAN.
2. PIM neighbor #1 sends a PIM Prune packet to the Security Gateway.
3. The Security Gateway starts a Prune-Pending Timer on the interface, on which it received this PIM Prune packet.
4. PIM neighbor #2 sends a PIM-Join packet to the Security Gateway before the Prune-Pending Timer expires.
5. When the Security Gateway goes to MRT, a timeout function executes.
6. As a result, the Security Gateway deletes the OIF even though the Security Gateway received a "Join" packet to keep the traffic flowing on that interface.

## Solution

This problem was fixed. The fix is included in:

* [Check Point Quantum R82](https://support.checkpoint.com/results/sk/sk181127)
* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 43
* [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 113
* [Jumbo Hotfix Accumulator for R81](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm) starting from Take 89
* [Jumbo Hotfix Accumulator for R80.40](https://sc1.checkpoint.com/documents/Jumbo_HFA/R80.40/Default.htm) starting from Take 211

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597).

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content