> Source: [sk184876](https://support.checkpoint.com/results/sk/sk184876)

# sk184876 - Internal DDoS port re-enables itself after being disabled in Maestro Security Gateways

| Property | Value |
|----------|-------|
| Solution ID | sk184876 |
| Date Created | 2026-05-13 |
| Last Modified | 2026-05-18 |
| Technical Level | General |
| Products | Security Gateway, Scalable Platforms |
| Versions | R81.20, R81.10 (EOS), R81.20, R81.10 (EOS) |
| OS | Gaia |
| Platform | 16000 |

## Symptoms

- The internal Distributed Denial of Service (DDoS) port becomes enabled again after an administrator disables it.
Administrators disable the internal DDoS port on the Security Gateway by running:   
`fwaccel dos config set --disable-internal`  

After some time, the internal DDoS port is enabled again without administrator action.

## Cause

In this software version, DDoS acceleration uses Indicators of Compromise (IoC) processing. During IoC handling, multiple internal components manage the DDoS internal port state.  
Under specific IoC processing conditions, one of these components resets the internal DDoS port to its default enabled state. This occurs independently of administrator actions and depends on IoC processing events.

## Solution

Added an option to disable enforcement on internal interfaces when IOC indicators are loaded. To configure this option, add or modify \[IOC\] `enable_internal_interface=<value>` in the file *$FWDIR/conf/malware_config* (for MDS, additionally in *$MDS_FWDIR/conf/malware_config* ).  

A private Hotfix is required to fully prevent IoC modules from re-enabling the internal DDoS port after it is disabled.  

This problem was fixed. The fix is included in:

* [Jumbo Hotfix Accumulator for R81.20](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.20/Default.htm) starting from Take 120
* [Jumbo Hotfix Accumulator for R81.10](https://sc1.checkpoint.com/documents/Jumbo_HFA/R81.10/Default.htm) starting from Take 183

If you choose not to upgrade, Check Point can supply a **Hotfix** . [Contact Check Point Support](https://www.checkpoint.com/support-services/.contact-support/) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk168597%22 target=).

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content