> Source: [sk42695](https://support.checkpoint.com/results/sk/sk42695)

# sk42695 - Active Cluster Member Rejecting Packets to a Non-Active Member (SSL, ICMP, etc..)

| Property | Value |
|----------|-------|
| Solution ID | sk42695 |
| Date Created | 2009-09-01 |
| Last Modified | 2020-06-28 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * Traffic does not pass through ClusterXL in High Availability mode.

* Cluster kernel debug ('`fw ctl debug -m cluster + forward`') shows:

  `FW-1: fwha_forw_ssl_handler: Rejecting ssl packets to a non-active member`
* Kernel debug (fw ctl zdebug drop) shows:

  `dropped by fwchain_reject_mtu Reason: rejected;`

## Cause

The `fwha_forw_c2s_handler` function on the cluster member checks the state of the member, to which the connection should be forwarded, and if the state of that member is not "Active" (e.g., Down, Standby), then the packet is rejected.

*Example 1* :  
`;FW-1: fwha_is_c2s_packet: is c2s, orig ip = 0xaaa1501, local IP = 0x315aa0a, proto = 1, dir = 1`  
`;FW-1: fwha_forw_run: conn_type=4`  
`;FW-1: fwha_forw_ssl_handler: Rejecting ssl packets to a non-active member(0). The other member state is 0`

*Example 2* :  
`;FW-1: fwha_is_c2s_packet: is c2s, orig ip = 0xa010902, local IP = 0xc24320a, proto = 1, dir = 1;`  
`;FW-1: fwha_forw_run: conn_type=4`  
`;FW-1: fwha_forw_ssl_handler: Rejecting ssl packets to a non-active member(1). The other member state is 2;`

Note: This is the complete list of possible states:

* 4 = Active/Active-Attention
* 3 = Ready
* 2 = Standby
* 1 = Initializing
* 0 = Down/Dead

When the value of kernel parameter ***fwha_forw_packet_to_not_active*** is set to 0, the packet forwarding is not done to a non-active member. Instead, a reset packet is sent to the client.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content