> Source: [sk75100](https://support.checkpoint.com/results/sk/sk75100)

# sk75100 - The 'ifconfig' / 'netstat' commands show that "TX drops" counter on the interface grows rapidly under load when SecureXL is enabled

| Property | Value |
|----------|-------|
| Solution ID | sk75100 |
| Date Created | 2012-06-01 |
| Last Modified | 2021-11-29 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * Outputs of '`ifconfig`' / '`netstat`' commands show that TX drops counter on the interface grows rapidly under load.  

* Drops on interface under load occur with SecureXL enabled.  

* SecureXL debug ('`sim dbg -m pkt + pkt`' and '`sim dbg -m drv + deliver`') shows these messages:  

  `[SIM]sim_filterout_do_deliver: can't XMT, queue stopped`  
  `[SIM]do_inbound_finish: cut-through: XMT FAILED!!! xmt_rc=-1`


  **Note**: In R80.20, "fwaccel dbg" replaces "sim dbg."

* Kernel debug ('`fw ctl debug -m fw + drop`') may show the following message:  
  `...dropped by do_inbound_finish, Reason: transmission failed;`

## Cause

The interfaces are busy and cannot accept packets coming from the SecureXL module.

## Solution

Follow these steps:

In cluster environment, this procedure must be performed on **all**members of the cluster.

**Check if Multi-Queue is enabled on one of the Security Gateway interfaces with the command:**
> ***cpmq get -a***  
>
> For more information on Multi-Queue, see [sk98348 - Best Practices - Security Gateway Performance](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98348)).

**If Multi-Queue is configured on one of the interfaces:**   

Check if the interface with the rx drops is connected to the Multi-Queue interface.  

If the answer to "1" is yes, check that this interface is also configured with Multi-Queue. If it is not, configure Multi-Queue on this interface.  

**If Multi-Queue is not configured on the Security Gateway:**   

1. For R76 and higher, skip to skip # 3.  

2. For R75.4X and lower, a Hotfix must first be installed.  
[Contact Check Point Support](http://www.checkpoint.com/support-services/contact-support/index.html) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.  
For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case.  
**Hotfix installation instructions:**

*
  *
    * Using CPUSE - On Security Gateway running Gaia OS R75.40 and higher:

      Make sure to install the [latest build of the CPUSE Agent](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#Latest build of CPUSE and What's New).

      Refer to [sk92449: CPUSE - Gaia Software Updates (including Gaia Software Updates Agent)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE):
      * Section "[(4-A-c)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to download and import a CPUSE package - Import instructions for Offline procedure - Gaia Portal)" / "[(4-A-d)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to download and import a CPUSE package - Import instructions for Offline procedure - Gaia Clish)" - refer to import instructions for *Offline procedure*
      * Section "[(4-B-a)](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#How to work with CPUSE - How to install a CPUSE package - Installing a Hotfix package / Minor Version package)" - refer to installation instructions for *Hotfixes*

      **Note:** Reboot is required.
    * Using Legacy CLI - On VSX Gateway running Gaia OS R75.40VS and higher; On Security Gateway running SecurePlatform/XOS/IPSO OS:

      Note: On these versions of VSX, the Gaia CPUSE does not support installation of hotfixes (refer to [sk92449](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk92449#System requirements and limitations) - section "(2)" - "VSX Gateways").
      1. Transfer the hotfix package to the machine (into some directory, e.g., */some_path_to_fix/*).

      2. Unpack and install the hotfix package:

         ***\[Expert@HostName\]# cd /some_path_to_fix/***   
         ***\[Expert@HostName\]# tar -zxvf sim_\<HOTFIX_NAME\>.tgz***   
         ***\[Expert@HostName\]# ./sim_\<HOTFIX_NAME\>***
         **Note:** The script will stop all of Check Point services (*cpstop*) - read the output on the screen.
      3. Do **NOT**reboot the machine yet.

3. Create the *$PPKDIR/boot/modules/simkern.conf* file (if it does not already exist):  
**In R80.10 and lower:** ***\[Expert@HostName\]# touch $PPKDIR/boot/modules/simkern.conf*** **In R80.20 and higher:** ***\[Expert@HostName\]# touch $PPKDIR/boot/modules/simkern.conf*** ***For R80.20SP:
\[Expert@HostName\]# touch/opt/CPppak-R80.20/conf/simkern.conf***

4. Edit the *$PPKDIR/boot/modules/simkern.conf* file in Vi editor:  
**In R80.10 and lower:** ***\[Expert@HostName\]# vi $PPKDIR/boot/modules/simkern.conf*** **In R80.20 and higher:**  
***\[Expert@HostName\]# vi $PPKDIR/conf/simkern.conf***  
**In R80.20SP:
\[Expert@HostName\]# vi/opt/CPppak-R80.20/conf/simkern.conf**

5.Add this line (spaces are not allowed):  
***sim_requeue_enabled=1***

6. Save the changes in the file and exit from Vi editor.

7. Check that the SecureXL parameter was added correctly:  
**R80.10 and lower:** ***\[Expert@HostName\]# cat $PPKDIR/boot/modules/simkern.conf*** **R80.20 and higher:** ***\[Expert@HostName\]# cat $PPKDIR/conf/simkern.conf***

8. Reboot the Security Gateway to apply the changes.

**Related Solutions:**

* [sk90740 - Latency after upgrade from NGX R65 to R75.x when SecureXL is enabled](http://supportcontent.checkpoint.com/solutions?id=sk90740)
* [sk84300 - Latency after upgrade from NGX R65 to R75.x](http://supportcontent.checkpoint.com/solutions?id=sk84300)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content