> Source: [sk85481](https://support.checkpoint.com/results/sk/sk85481)

# sk85481 - All SSH connections fail despite an explicit rule that allows SSH traffic

| Property | Value |
|----------|-------|
| Solution ID | sk85481 |
| Date Created | 2012-09-23 |
| Last Modified | 2013-06-10 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |

## Symptoms

- * All SSH connections fail despite an explicit rule that allows SSH traffic.
* Kernel debug (`fw ctl debug -m fw + drop`) shows:  

  `fw_log_drop: Packet proto=6 `*Source_IP* `:`*Source_Port*` -> `*Destination_IP* `:22 dropped by fw_handle_first_packet Reason: Rulebase reject - rule `*N*,  

  where *N* is the number of explicit rule that allows SSH traffic

## Cause

The following configuration causes the SSH connections to be rejected:

1. There is a rule that allows SFTP traffic. This rule is defined with a customized service that contains **"FTP"** string in its name in capital letters (e.g., *sFTP* , *SFTP*).
2. Anti-Virus Blade is enabled on Security Gateway/Cluster.

Explanation:

By design, if service name contains "FTP" string (in capital letters), this service will be added to '`ftp_services`' table in kernel. This table is inspected by the Anti-Virus engine.

SFTP and SSH traffic, by definition, works on TCP port 22.

The customized service for SFTP traffic caused the Anti-Virus engine to inspect the traffic on TCP port 22, as an FTP connection.

However, since neither SFTP traffic, nor SSH traffic is a real FTP connection, the Anti-Virus engine rejected the traffic on TCP port 22.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content