> Source: [sk181823](https://support.checkpoint.com/results/sk/sk181823)

# sk181823 - In a Maestro Security Group, a VSX Virtual System that connects to a Virtual Switch may drop traffic as "Out of State"

| Property | Value |
|----------|-------|
| Solution ID | sk181823 |
| Date Created | 2024-01-29 |
| Last Modified | 2024-02-04 |
| Technical Level | General |
| Products | Security Gateway, Scalable Platforms |
| Versions | R81.20, R81.10 (EOS), R81 (EOS), R81.20, R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- * Traffic logs from a Virtual System that connects to a Virtual Switch show that it drops some traffic as "Out of State", or wrongly drops it on a clean up rule.

* Traffic capture in the Security Group:

  1. shows the traffic entering the Virtual Switch
  2. shows the traffic exiting the the Virtual Switch
  3. does not show the relevant traffic entering the relevant Virtual System
  4. shows the traffic then exiting the relevant Virtual System
  5. shows the reply traffic entering the relevant Virtual System

## Cause

Traffic that arrives at the Virtual Switch is not forwarded correctly to the relevant Virtual System (skips it).

## Solution

This problem was fixed. The fix is included starting from:

* [Check Point R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 38
* [Check Point R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 113
* [Check Point R81](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81/Default.htm) starting from Take 89

Check Point recommends to always upgrade to the most recent version ([VSX](https://support.checkpoint.com/product/359)).

### Workaround Procedure

If you choose not to upgrade, follow this workaround procedure.

Configure the value of the kernel parameter `sim_warp_jump_strict_mac` to `0`.

The kernel parameter value of "`0`" configures SecureXL **not** to drop packets if they are sent to a MAC address that does not belong to the Virtual System / Virtual Switch that received these packets.

Follow the applicable procedure.

**To change the value of the SecureXL kernel parameter permanently (recommended - survives reboot):**

1. Connect to the command line of the Maestro Security Group.
2. Log in to the Expert mode.
3. Configure the value of the kernel parameter:  
   `g_update_conf_file $PPKDIR/conf/simkern.conf sim_warp_jump_strict_mac=0`
4. Reboot the Maestro Security Group:  
   `reboot -b all`
5. Connect to the command line of the Maestro Security Group.
6. Log in to Gaia gClish or the Expert mode.
7. Get the value of the kernel parameter (ignore the section "`FW:`"):
   * In Gaia gClish, run:  
     `fw ctl get int sim_warp_jump_strict_mac -a`
   * In the Expert mode, run:  
     `g_fw ctl get int sim_warp_jump_strict_mac -a`

**To change the value of the SecureXL kernel parameter temporarily (does not survive reboot):**   

1. Connect to the command line of the Maestro Security Group.
2. Log in to Gaia gClish or the Expert mode.
3. Configure the value of the kernel parameter:
   * In Gaia gClish, run:  
     `fw ctl set int sim_warp_jump_strict_mac 0 -a`
   * In the Expert mode, run:  
     `g_fw ctl set int sim_warp_jump_strict_mac 0 -a`
4. Get the value of the kernel parameter (ignore the section "`FW:`"):
   * In Gaia gClish, run:  
     `fw ctl get int sim_warp_jump_strict_mac -a`
   * In the Expert mode, run:  
     `g_fw ctl get int sim_warp_jump_strict_mac -a`

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content