> Source: [sk181967](https://support.checkpoint.com/results/sk/sk181967)

# sk181967 - Security Gateway does not forward packets to a specific subnet

| Property | Value |
|----------|-------|
| Solution ID | sk181967 |
| Date Created | 2024-02-11 |
| Last Modified | 2025-03-02 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Although the "`fw monitor`" tool shows that the packets pass through te Post-Outbound chain "`O`" on the correct interface, the `tcpdump` tool on the same outgoing interface does not show these packets.

* The static route is configured correctly and the next hop for the destination subnet is reachable.

  Example:

  `[Expert@HOSTNAME:0]# ip route get 192.168.xx.xx`  
  `
  192.168.xx.xx via 172.16.xx.xx dev eth1 src 172.16.xx.xx`  
  `
  cache`
* When the "`tcpdump`" is executed on the outgoing interface with an ARP packet filter, it shows the Security Gateway's transmission of ARP requests for the destination.

  However, there are no replies.

  Example:

  `Out [eth1] MAC [00:1c:7f:xx:xx:xx > ff:ff:ff:ff:ff:ff ethertype 0x806] ARP [who-has 192.168.xx.xx tell 172.25.xx.xx]`  

  `[Expert@HOSTNAME:0]# arp -an | grep 192.168.xx.xx`  
  `
  ? (192.168.xx.xx) at <incomplete> on eth1`

## Cause

When implementing Policy-Based Routing (PBR), packets are directed to traverse a specific interface rather than being routed based on a next-hop IP address.

In this scenario, the Security Gateway perceives the destination subnet as directly connected.

Consequently, when routing these packets, the Security Gateway initiates an Address Resolution Protocol (ARP) request for each destination host to acquire its MAC address. Failure to receive an ARP response for the destination host results in the packet being unforwarded.

For instance, consider the following configuration example: packets destined for the `192.168.0.0/16` network that arrive at the interface `eth2` will be forwarded through the interface `eth1`, treated as a directly connected network.  

`set pbr table ACTION-NAME static-route default nexthop gateway `logical eth1` priority 1`  
`set pbr rule priority 2 match to 192.168.0.0/16`  
`set pbr rule priority 2 match interface eth2`  
`set pbr rule priority 2 action table ACTION-NAME`

<br />

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content