> Source: [sk97876](https://support.checkpoint.com/results/sk/sk97876)

# sk97876 - Specific traffic is dropped by Security Gateway, although it should be accepted by the relevant security rule

| Property | Value |
|----------|-------|
| Solution ID | sk97876 |
| Date Created | 2013-12-25 |
| Last Modified | 2019-08-05 |
| Technical Level | Advanced |
| Products | Security Gateway, Security Management Server, Multi-Domain Security Management Server |
| Versions | R82.10, R82, R81.20, R82.10, R82, R81.20, R82.10, R82.20, R81.20, R82, R82.20 |

## Symptoms

- * SmartView Tracker shows that specific traffic is dropped by Security Gateway, although it should be accepted by the relevant security rule.  

* Issue is resolved when moving the security rule that should have accepted the traffic to a higher position in the rulebase.  

* Issue is resolved when in the service located in the security rule that drops the traffic, setting the 'Protocol Type' to 'None' (right-click on the service - '`Edit...`' - '`Advanced...`' button).  

* Issue is resolved when unchecking the box 'Match for 'Any'' in the service located in the security rule that drops the traffic (right-click on the service - '`Edit...`' - '`Advanced...`' button).  

* Kernel debug ('`fw ctl debug -m fw + drop tcpstr`') might show the following drops for traffic that should have been accepted:

  ```
  
  ;fwpslglue_chain: dropping packet, message "PSL Drop: ASPII_MT";
  ;fw_log_drop: Packet proto= ... dropped by fwpslglue_chain Reason: PSL Drop: ASPII_MT;
  ```

## Cause

In FireWall rulebase, the Service may be evaluated before evaluating the Source or the Destination.

*Example*:

* Configuration:

  * '`CACTI`' object represent SNMP Management machine that queries Hosts on the network.
  * '`snmp_v3`' is a custom service, in which '`Protocol Type`' was set to '`SNMP_V3`'.
  * '`snmp`' is a pre-defined service, in which '`Protocol Type`' is not set at all.
  * Rulebase (pay attention to the order of the security rules):  

    |-----|--------|-------------|-----------|----------|-------|
    | NO. | SOURCE | DESTINATION | SERVICE   | ACTION   | TRACK |
    | 1   | CACTI  | `Any`       | `snmp_v3` | `Accept` | `Log` |
    | 2   | `Any`  | CACTI       | `snmp_v3` | `Accept` | `Log` |
    | 3   | `Any`  | `Any`       | `snmp`    | `Accept` | `Log` |

* Issue:

  * Both SNMP v1 traffic and SNMP v2 traffic were dropped, although this traffic was not sent to / from '`CACTI`' object.
* Workarounds:

  * Moving the rule with pre-defined service '`snmp`' (that should accept both SNMP v1 / SNMP v2 traffic) above the rules with custom service '`snmp_v3`'.
  * In the custom service '`snmp_v3`', setting the '`Protocol Type`' to '`None`'.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content