> Source: [sk183230](https://support.checkpoint.com/results/sk/sk183230)

# sk183230 - "The probe was unable to establish a TCP connection to the destination" error when HTTPS Inspection is enabled

| Property | Value |
|----------|-------|
| Solution ID | sk183230 |
| Date Created | 2025-03-11 |
| Last Modified | 2026-05-09 |
| Technical Level | Advanced |
| Products | Security Gateway, Scalable Platforms |
| Versions | R82, R81.20, R81.10 (EOS), R82, R81.20, R81.10 (EOS) |

## Symptoms

- * "*The probe was unable to establish a TCP connection to the destination*" error in SmartConsole logs when HTTPS Inspection is enabled.

* Custom application site / Categories are used in the HTTPS Inspection policy.

* The errors are generated even when the relevant connection hits a bypass rule.

## Cause

The Security Gateway was unable to perform the probe. This is usually because the TLS handshake was not successful. In most cases, this is either an issue of the server site not responding with the proper response or a connectivity issue from the Security Gateway to the server.

**What is probing?**   
Probing is a mechanism that the Firewall uses to validate the server's certificate before making a decision in the HTTPS Inspection policy.  

The Firewall initiates a TLS connection with the destination server (TCP + TLS handshake).  
If this connection fails or not completed, the Firewall generates the error "The probe was unable to establish a TCP connection".  

**When probing is expected?**   
The Security Gateway initiates HTTPS probing when inspection is needed to correctly match traffic against the HTTPS Inspection Outbound Rule Base. This occurs when a rule includes Custom Applications/Sites or Categories regardless of the action (`Bypass` or `Inspect`), or when traffic is expected to match a rule with the action set to "`Inspect`".  

<br />

**Example**   
![](https://sc1.checkpoint.com/sc/SolutionsStatics/NEW_SK_NOID1741696209506/probing202503111503131.png)  

1st rule: Traffic from any source to Webex Services (an updatable object) destination. No Category / Custom application site is selected. Action is Bypass  
2nd rule: Traffic from a specific source IP address to a specific destination IP address. No Category / Custom application site is selected. Action is Inspect.  
3rd rule: Traffic from a specific source IP address to the Internet (any external IP per topology). The Security Gateway must match the "test" custom application site as well. Action is Inspect.  
4th rule: Traffic from any source IP address to the Internet. No Category / Custom application site is selected. Action is Bypass  

Client1 tries to reach `https://example.com`  
Rule 1 is not a possible match, because `example.com` is not a match for the destination column.  
Rule 2 is not a possible match, because `example.com` is not a match for the destination column.  
Rule 3 is a possible match, because the IP address of `example.com` is an external IP address and we match the source column (Client1).  

However, we still cannot guarantee that rule 3 is a match because we do not know if it matches the "test" Custom Application site.  

So, the traffic must still be inspected before determining whether Rule 3 is a match; therefore, the Security Gateway initiates a **probe** .  

Based on the result, the Security Gateway matches the connection to rule 3 or continues to the rest of the Rule Base after the probe is successful or drop / bypass the connection according to as configured in HTTPS Inspection's Advanced Settings.  

**Note - probing occurs once.**   
The probe state will be cached in the firewall kernel in case the probe is successful and the certificate is validated.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content