> Source: [sk77240](https://support.checkpoint.com/results/sk/sk77240)

# sk77240 - NATed VPN traffic that passes through Security Gateway is dropped when SecureXL is enabled

| Property | Value |
|----------|-------|
| Solution ID | sk77240 |
| Date Created | 2012-06-19 |
| Last Modified | 2023-05-07 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * NATed VPN traffic (ESP protocol) that passes through Security Gateway is dropped when SecureXL is enabled.  

* When SecureXL is disabled, NATed VPN traffic (ESP protocol) passes through Security Gateway correctly.  

* When Anti-Spoofing is disabled or when the involved IP address are excluded, NATed VPN traffic (ESP protocol) passes through Security Gateway correctly.  

* Kernel debug (`fw ctl debug -m fw + conn drop nat link``) shows:
  `  

  `
  ``
  ;fw_handle_first_packet: Rulebase returned ACCEPT;`  
  `
  ;fw_xlate_match: conn=<`*Source_IP* `:0 -> `*Dest_IP* `:0 IPP 50>;`  
  `
  ;fw_xlate_match: cache hit!;`  
  `
  ;fwconn_init_links: Creating links (inbound). One way links=0, Replies from any=0;`  
  `
  ;fwconn_set_links_inbound: create link cls_o <dir 1, `*Dest_IP* `:0 -> `*Source_IP* `:0 IPP 50> -> <dir 0, `*Source_IP* `:0 -> `*Dest_IP* `:0 IPP 50>(0x5);`  
  `
  ;fwconn_set_link: failed to set the link (-3);`  
  `
  ;fwconn_set_link: link collision ignored by SXL;`  
  `
  ;fw_handle_first_packet: fwconn_init_links failed. Dropping packet;`  
  `
  ;fw_log_drop: Packet proto=50 `*Source_IP* `:`*Source_Port*` -> `*Dest_IP* `:`*Dest_Port*` dropped by fw_handle_first_packet Reason: fwconn_init_links (INBOUND) failed;`  
  `
  ;fw_filter_chain: handle_first_packet returned action DROP for new conn;`  
  `
  ;fw_filter_chain: Final switch, action=DROP;`  
  `
  ;fw_filter_chain: Removing partially setup connection;
  `

## Cause

In some scenarios, a packet is forwarded by SecureXL (F2F) after NAT is applied by SecureXL. Special link needs to be created in the Connections Table when the connection is created. Currently, such special link is created only for TCP and UDP connections.

## Solution

This problem was fixed. The fix is included in:

* [Check Point R75.45](http://supportcontent.checkpoint.com/solutions?id=sk82740)

**Note:** Permanently set the value of kernel parameter **`fwconn_set_esp_after_nat_links`** to **1** - follow [sk26202 (Changing the kernel global parameters for Check Point Security Gateway)](http://supportcontent.checkpoint.com/solutions?id=sk26202).

Check Point recommends to always [upgrade to the most recent version](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doShowproductpage&productTab=downloads&product=73).

For **lower versions** , Check Point can supply a **Hotfix** . [Contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) to get a Hotfix for this issue.  
A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

**Hotfix installation instructions:**

1. Hotfix has to be installed on **Security Gateway** .   

2. Transfer the hotfix package to the machine (into some directory, e.g., `/some_path_to_fix/`).   

3. Unpack the hotfix package:   

   **`[Expert@HostName]# cd /some_path_to_fix/`**   
   **`[Expert@HostName]# tar -zxvf fw1_wrapper_`*HOTFIX_NAME*`.tgz`**   

4. Install the hotfix:   

   **`[Expert@HostName]# ./fw1_wrapper_`*HOTFIX_NAME***   

   Note: The script will stop all the Check Point services (`cpstop`) - read the output on the screen.   

5. Do NOT reboot the machine yet.   

6. Permanently set the value of kernel parameter **`fwconn_set_esp_after_nat_links`** to **1** (one) - follow [sk26202 (Changing the kernel global parameters for Check Point Security Gateway)](http://supportcontent.checkpoint.com/solutions?id=sk26202).   

7. Reboot the machine.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content