> Source: [sk183946](https://support.checkpoint.com/results/sk/sk183946)

# sk183946 - The BGP session cannot automatically re-establish after the VXLAN tunnel reset in the Cloud Firewall for Azure environment

| Property | Value |
|----------|-------|
| Solution ID | sk183946 |
| Date Created | 2025-09-18 |
| Last Modified | 2026-05-11 |
| Technical Level | General |
| Products | Cloud Firewall |
| Versions | R82.10, R81.10 (EOS), R81.20, R82 |

## Symptoms

- * The BGP tunnel is established over the VXLAN network.
* The `tcpdump` command shows that outbound traffic is not being NATed to the cluster VIP.
* The NAT-specific kernel debug command returns the following output: `fw ctl debug -m fw + conn packet nat xlate xltrc`

  *Azure: Never do cluster NAT-hide in Azure, if it's not VTI*
* Logs from `routed_messages` indicate a connection collision occurring during the re-establishment of the BGP tunnel.

## Cause

In the Cloud Firewall for Azure cluster environment, the kernel parameter `fw_azure_mode `is enabled by default to support Azure-specific networking requirements. When it is enabled, the cluster-level NAT hide is globally disabled. As a result, outbound VXLAN-related traffic uses the IP address of the active cluster member as the source, instead of the cluster Virtual IP address (VIP).  

Since VXLAN packets are encapsulated within UDP headers, the Azure infrastructure only sees the outer VXLAN tunnel headers and cannot inspect or interfere with the inner packet contents. This means Azure cannot detect or block the use of the cluster VIP address within the VXLAN payload.  

Consequently, the BGP peer expects traffic from the cluster VIP address but instead receives it from the IP address of the active member. This source IP address mismatch leads to connection collisions and failed BGP negotiations.

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
For faster resolution and verification, collect these files:

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member / Security Group involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content