> Source: [sk182573](https://support.checkpoint.com/results/sk/sk182573)

# sk182573 - Reply packets drop with "First packet isn't SYN" in Azure vWAN when destination NAT is configured

| Property | Value |
|----------|-------|
| Solution ID | sk182573 |
| Date Created | 2024-08-07 |
| Last Modified | 2026-05-11 |
| Technical Level | General |
| Products | Cloud Firewall |
| Versions | R82.10, R81.20, R82 |
| OS | Gaia |
| Platform | Azure |

## Symptoms

- * When you implement destination NAT in Azure vWAN, the first packet passes, but another Network Virtual Appliance (NVA) drops the reply packet with a "First packet isn't SYN" error log.

  An example configuration of a destination NAT rule when the issue occurs:  


  ![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1723032124081/NAT01202408071412561.jpg)
* Some connections work when the Azure load balancer sends the reply packets to the same NVA instance, but this is unpredictable.

## Cause

The Azure load balancer sends the incoming traffic to one of the Azure vWAN Cloud Firewall NVA instances.

Because the vWAN NVA is changing the IP addresses (which can also happen if only the ports are changed), the return traffic is seen as a new connection, and the load balancer can send it to a different vWAN NVA instance, which drops it.

## Solution

This behavior is by design in Azure and is not related to the Check Point Cloud Firewall NVA.  

To achieve a persistent connection with Destination NAT, use a combination of Destination NAT with Hide NAT and the Dynamic Object "*LocalGatewayExternal* " as described in [Cloud Firewall for Azure Virtual WAN Deployment Guide](https://sc1.checkpoint.com/documents/IaaS/WebAdminGuides/EN/CP_CloudGuard_Network_for_Azure_vWAN/Default.htm "Cloud Firewall for Azure Virtual WAN Deployment Guide") \> Integrating Cloud Firewall NVA with Azure Virtual WAN section \> Step 7: Configure NAT.

An example of a NAT rule with the "*LocalGatewayExternal*" object:

![NAT - Example working](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1723032124081/NAT02202408071420362.jpg)

**Note:** Keep in mind that this might have other implications because the real source IP address is hidden behind each individual NVA instance IP address. Depending on the number of instances, this can be two or more IP addresses.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content