> Source: [sk81320](https://support.checkpoint.com/results/sk/sk81320)

# sk81320 - DNS packets are 'dropped by fwpslglue_chain Reason: PSL Drop: ASPII_MT' on Security Gateway

| Property | Value |
|----------|-------|
| Solution ID | sk81320 |
| Date Created | 2012-09-13 |
| Last Modified | 2021-01-20 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R81 (EOS) |

## Symptoms

- * Not possible to connect to network resources by their hostnames through Security Gateway.  

* Kernel debug (`fw ctl debug -m fw + drop`) shows that DNS packets are dropped:  
  `fw_log_drop: Packet proto=17 `*Source_IP* `:`*Source_Port*` -> `*Dest_IP*`:53 dropped by fwpslglue_chain Reason: PSL Drop: ASPII_MT`   

  **Important:** Run debug as follows:   
  *fw ctl debug 0
  fw ctl debug -m fw + drop
  fw ctl kdebug -f \> \<filename\>*   
  Ctrl C to stop  
  *fw ctl debug 0*
* DNS drops occur on the Security Gateway side (not on the Client side).

## Cause

Possible reasons:

* The DNS Server is reusing source ports.  

* In R75.40 and higher, Anti-Malware blades (Anti-Bot and Anti-Virus) hold this DNS connection while trying to categorize it (when 'Resource Categorization mode' is set to 'Hold'). The FireWall drops this DNS connection (when a connection cannot be categorized with the cached responses).   
  Note: Anti-Malware blades later inject this DNS connection again when the categorization is complete.  

* Application Control blade is enabled with a restrictive policy (blocks any recognized traffic).

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content