> Source: [sk182855](https://support.checkpoint.com/results/sk/sk182855)

# sk182855 - Policy installation fails with this error: "Installation fails. Reason:Due to a timeout value of 3600000 (millisecond) (port=18191) (IP=x.x.x.x), Security Management Server aborted the connection with the peer"

| Property | Value |
|----------|-------|
| Solution ID | sk182855 |
| Date Created | 2024-12-16 |
| Last Modified | 2024-12-29 |
| Technical Level | Advanced |
| Products | Security Gateway, Security Management Server |
| Versions | R82, R81.20, R82, R81.20 |
| OS | Gaia |
| Platform | 7000 |

## Symptoms

- * Policy installation fails with this error: "*Installation failed. Reason: Due to a timeout value of 3600000 (millisecond) (port=18191)(IP=x.x.x.x), Security Management Server aborted the connection with the peer.*"

* Kernel debug on cluster members ("`fw ctl zdebug + drop`") shows that the cluster members drop the traffic:   

  `fw_log_drop_ex: Packet proto=` : -> : dropped by fw_conn_inspect Reason: Frozen connection (FWCONN_KTYPE_DROP) - connection packets in this direction are dropped;

## Cause

By default, cluster members use the Flush and Ack mechanism to update each other about connections they inspect. This involves:

* Sending (Flush) delta synchronization information between cluster members.
* Waiting for acknowledgment (Ack) from the peer cluster member.

During this process:

* The cluster members freeze (drop) new packets in the relevant connections, to make sure the cluster members synchronize all information.
* High traffic volume can lead to timeouts during synchronization.

This kernel parameter controls the connection freeze:

* `fw_allow_connection_traffic_drop=1` (default):  
  Cluster members "freeze" the connection. They drop the new packets until the peer cluster members acknowledge they received the delta synchronization for the previous packets of the connection.

<!-- -->

* `fw_allow_connection_traffic_drop=0`:  
  The cluster members do not "freeze" the connection. They do not drop the new packets of a connection until the peer cluster members acknowledge that they received the delta synchronization for the previous packets of this connection. As a result, cluster members cannot synchronize all packets of this connection.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content