> Source: [sk60160](https://support.checkpoint.com/results/sk/sk60160)

# sk60160 - After a failover, cluster drops traffic with "dropped by fwpslglue_chain Reason: PSL Reject: failover occured and connection is marked for reject"

| Property | Value |
|----------|-------|
| Solution ID | sk60160 |
| Date Created | 2010-12-22 |
| Last Modified | 2025-01-16 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20, R81.10 (EOS), R81 (EOS) |

## Symptoms

- * Traffic outage after a cluster failover in ClusterXL High Availability.

* Kernel debug ('`fw ctl debug -m fw + drop`') on the cluster members shows that the Active cluster member drops the traffic:

  `... dropped by fwpslglue_chain Reason: PSL Reject: failover occured and connection is marked for reject;`

## Cause

The IPS Sofware Blade in the cluster object is configured to prefer security over connectivity (in SmartConsole R80 and higher / SmartDashboard R77.30 and lower, open the cluster object \> go to the "`IPS`" pane \> in the "`Failover Behavior`" section, select the option "`Prefer security - Close connections for which IPS cannot be guaranteed`").

Cluster Members do not synchronize IPS information for most protocols. Therefore, if a cluster failover occurs, it is more secure to drop a connection rather than to keep it.

In other words, when a failover happens between the cluster members, the new Active member does not have the data the IPS engine has collected so far about this connection.

Example:

1. An attack took place on a certain connection that was divided into 4 packets, and 3 packets were accepted on the former Active member.
2. At this point a cluster failover occurs.
3. The new Active member does not have the data of the first 3 packets, but only received the 4th packet.
4. It is more secure to terminate the connection rather than to keep it alive.

Connection behavior after a failover when you select "**Preferred security**" in the IPS settings:

* UDP packets are always dropped because they are stateless.
* ICMP connections are not dropped.
* Fully accelerated TCP connections are not rejected.
* All other TCP connections are rejected.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content