> Source: [sk182270](https://support.checkpoint.com/results/sk/sk182270)

# sk182270 - Connection from a Multi-User Host (MUH) agent is dropped on the cleanup rule

| Property | Value |
|----------|-------|
| Solution ID | sk182270 |
| Date Created | 2024-05-02 |
| Last Modified | 2024-05-07 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81.20, R81.10 (EOS), R81 (EOS) |
| OS | Gaia |

## Symptoms

- * Security Gateway drops a connection from a Multi-User Host (MUH) agent on the cleanup rule.

* You can see that the user is authenticated in MUH GUI, and you can find it with PDP and PEP commands:  


  `
  # pdp monitor user <username>`  
  `
  # pep show user query usr <username>
  `

* The connection from the same user sometimes hits the correct rule in the policy (his access role) and sometimes hits the cleanup rule.

* A kernel debug of the module "IDAPI + all" while the issue occurs shows the log:  

  `
  "idapi_is_known_muh2_client: ip ` is not a known muh2 client;"  


  A kernel debug of the module "IDAPI + all" while the issue does not occur shows the log:  

  `
  "idapi_is_known_muh2_client: ip ` is a known muh2 client;"

* The user's ID range matches the ID you see in the SYN packet.  


  To find the ID range, run the command:  

  `# pdp monitor user <username>`  


  To see the ID in the traffic capture open the *.pcap* file in Wireshark and go to IPv4 header \> Identification.

* Generating a *.txt* file with the command below shows different values in the VALS column for the instances:  

  `
  # FW_INST_NUM=$(fw ctl get int fwmultik_instance_num)`  
  `
  # for i in $(seq 0 $((FW_INST_NUM - 1))); do printf "fw instance $i\n" && fw -i $i tab -t pep_id_range_db -s && printf "\n"; done &> pep_id_range_db_multik_summary.txt`  
  `
  `

  For example:  

  ```
  
  fw instance 6
  HOST                  NAME                                ID #VALS #PEAK #SLINKS
  localhost             pep_id_range_db                    312    59    59       0
  
  fw instance 7
  HOST                  NAME                                ID #VALS #PEAK #SLINKS
  localhost             pep_id_range_db                    312    18    18       0
  ```

## Cause

A sync issue between the Firewall instances causes the instance that handles the connection not to find the user IP address in the PDP/PEP table while other instances can find it.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content