> Source: [sk183708](https://support.checkpoint.com/results/sk/sk183708)

# sk183708 - DLP exclusion not applied to FTP connections after policy changes

| Property | Value |
|----------|-------|
| Solution ID | sk183708 |
| Date Created | 2025-07-28 |
| Last Modified | 2025-08-07 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS) |
| OS | Gaia |

## Symptoms

- * Data Loss Prevention (DLP) inspects FTP connections even though exclusions are configured in SmartDashboard \> DLP \> My organization \> Exclusions for specific sources.

* Configuring fast_accel (as per [sk156672](https://support.checkpoint.com/results/sk/sk156672)) does not resolve the issue, as DLP is handled in slow_path, which fast_accel cannot accelerate.

* The **Data** column in the DLP policy is set to **None** for all rules.

* Kernel debugs for *dlpk* module (`fw ctl debug -m dlpk + all`) shows that the Security Gateway does not find matching entries in the DLP exclusion list:

  ```
  
  [DATE TIME];[vs_0];[tid_4];[fw4_4];dlpk_should_inspect_cpip: methods=(by dir,,+vpn) ipsrc=192.168.x.x ipdst=192.168.x.x 
  inzone=FWZONE_INTERNAL_ZONE outzone=FWZONE_EXTERNAL_ZONE;
  [DATE TIME];[vs_0];[tid_4];[fw4_4];dlpk_should_inspect_cpip: checking layer3 interface type (ifn=3), ipdst=192.168.11.237;
  [DATE TIME];[vs_0];[tid_4];[fw4_4];dlpk_resolve_if_type_for_layer3_automatically: entered with: src_ifn=3, dst_ip=192.168.11.237;
  [DATE TIME];[vs_0];[tid_4];[fw4_4];dlpk_resolve_if_type_for_layer3_automatically: found dst_ifn=4;
  [DATE TIME];[vs_0];[tid_4];[fw4_4];dlpk_should_inspect_cpip: got ifs_types(src)=4, ifs_types(dst) = 1;
  [DATE TIME];[vs_0];[tid_4];[fw4_4];dlpk_should_inspect_cpip: in ifs_type=4, out ifs_type=1;
  [DATE TIME];[vs_0];[tid_4];[fw4_4];dlpk_should_inspect_cpip: DLP should be invoked. Reason: DLP is by direction and source IP is not in exclusion list; 
  ```

  <br />

* The DLP exclusion tables on the Security Gateway / Cluster member does not have any entries, for example:  

  ```
  
  [Expert@Emulator: 0]# fw tab -t 8019 -u
  localhost: 
  --------DLP_my_org_exclusion_tab--------
  static, id 8019
  
  [Expert@Emulator: 0]# fw tab -t 8028 -u
  localhost: 
  --------DLP_exclusion_tab--------
  static, id 8028
  ```

  <br />

## Cause

The Data column in the DLP policy rules is set to None. When the DLP policy is installed with this configuration, the firewall does not load any entries from the exclusion list into the DLP exclusion tables. As a result, exclusions configured in SmartDashboard are ignored during policy enforcement.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content