> Source: [sk98070](https://support.checkpoint.com/results/sk/sk98070) # sk98070 - Traffic sent over a VPN tunnel does not reach its destination because SecureXL does not start fragmenting the packets | Property | Value | |----------|-------| | Solution ID | sk98070 | | Date Created | 2014-01-05 | | Last Modified | 2026-02-18 | | Technical Level | General | | Products | Security Gateway | | Versions | R82.10, R82, R81.20, R81.10 (EOS), R81 (EOS) | ## Symptoms - * Traffic sent over a VPN tunnel does not reach its destination. * When SecureXL is disabled, the traffic passes over the VPN tunnel correctly. * When SecureXL is enabled, it is not possible to download even a 2kB file. * When SecureXL is enabled, and the SecureXL kernel parameter '`sim_keep_DF_flag`' (refer to [sk92465](http://supportcontent.checkpoint.com/solutions?id=sk92465)) is manually set to 0 (in R76 and above, the default value is 1), the traffic passes over the VPN tunnel correctly. However, the Security Gateway loses the improved ability to send a ICMP "`Fragmentation Needed`" message to try to avoid fragmentation. ## Cause SecureXL does not start fragmenting the encrypted packets. As a result, traffic sent over the VPN tunnel is dropped. By default, when SecureXL is enabled, and the SecureXL kernel parameter '`sim_keep_DF_flag`' is set to 1 (the default value for Security Gateway versions R75.47 / R76 / R77 and above), if the packet's size exceeds MTU after encryption, the Security Gateway drops the traffic and sends an ICMP "`Fragmentation Needed`" message. However, if the Host does not comply and does not lower the MTU (e.g., it never received the ICMP "`Fragmentation Needed`" message), then the Security Gateway will continue to drop the encrypted packets. By default, without SecureXL, after 4 seconds, the Security Gateway stops dropping and starts fragmenting the encrypted packets. ## Solution (I) Code was improved in the following way (see the relevant instructions below): --------------------------------------------------------------------------------- * The behavior of the SecureXL kernel was changed (similar to the FireWall kernel): 1. A new kernel table ***ipsec_mtu_icmp*** was added to SecureXL to store the IP Addresses of the hosts to which the Security Gateway sends ICMP "Fragmentation Needed" packets (sources of clear-text packets, in which the "Do Not Fragment" flag is set). **Note** : In FireWall kernel, the corresponding kernel table is called ***IPSEC_mtu_icmp***. 2. SecureXL stores in the table *ipsec_mtu_icmp* the IP Address of the hosts to which the Security Gateway sends the ICMP "*Fragmentation Needed*" message. 3. Before sending the ICMP "*Fragmentation Needed*" message to the host, SecureXL checks whether the host's Destination IP address is in this table. 4. If the host's Destination IP address is indeed in this table, then SecureXL checks in the table *ipsec_mtu_icmp* whether the connection's timeout has been reached (refer to the SecureXL kernel parameter **`sim_ipsec_mtu_icmp_tmo`** below). 5. If the connection's timeout has not yet been reached, then the Security Gateway sends ICMP "*Fragmentation Needed* " message to the host and waits for the host to decrease the MTU of clear-text packets (refer to the SecureXL kernel parameter **`sim_ipsec_mtu_icmp_wait`** below). 6. If the connection's timeout has already been reached, then SecureXL fragments the encrypted packet, even if the "Do Not Fragment" flag is set in the clear-text packet. * To print the content of the new SecureXL kernel table ***ipsec_mtu_icmp***, run the following on the Security Gateway (the syntax is case-sensitive): ***\[Expert@HostName\]# sim tab ipsec_mtu_icmp*** **Note:** The table output will be printed into the */var/log/messages* file. **Note:** In the**R80.20 Gateway** , the ***sim tab*** command is replaced by the ***fwaccel tab*** command. *Example* : > > ``` > Feb 19 13:18:41 2017 MyFW kernel: [SIM4]; > Feb 19 13:18:48 2017 MyFW kernel: [SIM4]; Source_IP Dest_IP MTU Expires > Feb 19 13:18:48 2017 MyFW kernel: [SIM4]; < 192.168.90.1 172.16.7.5 1438 592/600> > Feb 19 13:18:48 2017 MyFW kernel: [SIM4]; < 192.168.90.4 172.16.7.5 1438 589/600> > ``` * The new kernel parameter ***sim_ipsec_dont_fragment*** was added to SecureXL to enable / disable the new fragmentation behavior: |---------------------------------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Value of kernel parameter | Description | | ***sim_ipsec_dont_fragment=0*** | Default value. Old behavior (refer to the "Cause" section). | | ***sim_ipsec_dont_fragment=1*** | New fragmentation behavior. Add this line to the file and reboot: R80.10 and lower: *$PPKDIR/boot/modules/simkern.conf* R80.20 and above: *$PPKDIR/conf/simkern.conf* | * New kernel parameters were added to SecureXL to fine-tune the new behavior: |-------------------------------|---------------|-----------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | Kernel parameter | Default value | Accepted values | Description | | ***sim_ipsec_mtu_icmp_wait*** | 2 | 1 - 10 | How much time (in seconds) to wait for the source of the clear-text packet to change the MTU before starting to fragment the encrypted packet, even if "Do Not Fragment" flag is set in the clear-text packet | | ***sim_ipsec_mtu_icmp_tmo*** | 600 | 0 - 86,400 | Expiration time (in seconds) of an entry in the new SecureXL table ***ipsec_mtu_icmp*** , after which the entry would be deleted from this table. | | ***sim_ipsec_mtu_tab_size*** | 25,000 | 0 - 4,000,000 | Size (number of entries) of the new SecureXL table ***ipsec_mtu_icmp*** | **Notes:** * If values that are less / greater than the accepted limits are defined, then default values will be used. * If the number of entries in the new SecureXL table *ipsec_mtu_icmp* has reached its limit size, then the new packets will be fragmented. (II) Configuration Instructions: -------------------------------- Click Here to Show All Instructions * **Show / Hide instructions for R77.30 and above** **Note:** In cluster environment, this procedure must be performed on *all* members of the cluster. Enable the new fragmentation SecureXL behavior - set the value of new SecureXL kernel parameter ***sim_ipsec_dont_fragment*** to 1 (one) on **Security Gateway / *each* cluster member**: 1. Create the relevant configuration file if it does not already exist: **R80.10 and lower:** ***\[Expert@HostName\]# touch $PPKDIR/boot/modules/simkern.conf*** **R80.20 and higer: */opt/CPppak-R80.20/conf/simkern.conf*** By default, the file should be created with permissions "`rw`" and should belong to "`admin:root`". Example for R80.10 and lower: ``` [Expert@MyFW:0]# ls -l $PPKDIR/boot/modules/simkern.conf -rw-rw---- 1 admin root 0 Feb 19 13:29 /opt/CPppak-R77/boot/modules/simkern.conf [Expert@MyFW:0]# ``` **Note** : In R80.20 and higher, the correct file path is *$PPKDIR/conf/simkern.conf* 2. Edit the configuration file: **R80.10 and lower** :***\[Expert@HostName\]# vi $PPKDIR/boot/modules/simkern.conf*** **R80.20 and higher: \[Expert@HostName\]# vi $PPKDIR/boot/modules/simkern.conf** 3. Add the following line (spaces are not allowed): ***sim_ipsec_dont_fragment=1*** 4. If needed, add the additional parameters to fine-tune the new behavior. 5. Save the changes in the file and exit from Vi editor. 6. Check the configuration file: **In R80.10 and lower: *\[Expert@HostName\]# cat $PPKDIR/boot/modules/simkern.conf*** **In R80.20 and higher: \[Expert@HostName\]# cat $PPKDIR/conf/simkern.conf** 7. Reboot the Security Gateway / each cluster member.

* **Show / Hide instructions for R77.20** **Note:** In cluster environment, this procedure must be performed on *all* members of the cluster. 1. Install ***Take_31* or above** of [sk101975 - Jumbo Hotfix Accumulator for R77.20 (R77_20_jumbo_hf)](http://supportcontent.checkpoint.com/solutions?id=sk101975) on **Security Gateway / each cluster member**. 2. Do NOT reboot yet. 3. Enable the new fragmentation SecureXL behavior - set the value of new SecureXL kernel parameter ***sim_ipsec_dont_fragment*** to 1 (one): 1. Create the relevant configuration file if it does not already exist: ***\[Expert@HostName\]# touch $PPKDIR/boot/modules/simkern.conf*** By default, the file should be created with permissions "`rw`" and should belong to "`admin:root`". *Example* : ``` [Expert@MyFW:0]# ls -l $PPKDIR/boot/modules/simkern.conf -rw-rw---- 1 admin root 0 Feb 19 13:29 /opt/CPppak-R77/boot/modules/simkern.conf [Expert@MyFW:0]# ``` 2. Edit the configuration file: ***\[Expert@HostName\]# vi $PPKDIR/boot/modules/simkern.conf*** 3. Add the following line (spaces are not allowed): ***sim_ipsec_dont_fragment=1*** 4. If needed, add the additional parameters to fine-tune the new behavior. 5. Save the changes in the file and exit from Vi editor. 6. Check the configuration file: ***\[Expert@HostName\]# cat $PPKDIR/boot/modules/simkern.conf*** 4. Reboot the Security Gateway / each cluster member.

* **Show / Hide instructions for R77.20.15 and above on SMB appliances** **Note:** In cluster environment, this procedure must be performed on *all* members of the cluster. Enable the new fragmentation SecureXL behavior - set the value of new SecureXL kernel parameter ***sim_ipsec_dont_fragment*** to 1 (one): 1. Create the relevant configuration file if it does not already exist: ***\[Expert@HostName:0\]# touch $FWDIR/modules/simkern.conf*** 2. Edit the configuration file: ***\[Expert@HostName:0\]# vi $FWDIR/modules/simkern.conf*** 3. Add the following line (spaces are not allowed): ***sim_ipsec_dont_fragment=1*** 4. If needed, add the additional parameters to fine-tune the new behavior. 5. Save the changes in the file and exit from Vi editor. 6. Check the configuration file: ***\[Expert@HostName:0\]# cat $FWDIR/modules/simkern.conf*** 7. Reboot the appliance.

* **Show / Hide instructions for R77.10** **Note:** In cluster environment, this procedure must be performed on *all* members of the cluster. 1. Install ***Take_88* or above** of [sk98285 - Jumbo Hotfix Accumulator for R77.10 (gypsy_hf_base_021)](http://supportcontent.checkpoint.com/solutions?id=sk98285) on **Security Gateway / each cluster member**. 2. Do NOT reboot yet. 3. Enable the new fragmentation SecureXL behavior - set the value of new SecureXL kernel parameter ***sim_ipsec_dont_fragment*** to 1 (one): 1. Create the relevant configuration file if it does not already exist: ***\[Expert@HostName\]# touch $PPKDIR/boot/modules/simkern.conf*** By default, the file should be created with permissions "`rw`" and should belong to "`admin:root`". *Example* : ``` [Expert@MyFW:0]# ls -l $PPKDIR/boot/modules/simkern.conf -rw-rw---- 1 admin root 0 Feb 19 13:29 /opt/CPppak-R77/boot/modules/simkern.conf [Expert@MyFW:0]# ``` 2. Edit the configuration file: ***\[Expert@HostName\]# vi $PPKDIR/boot/modules/simkern.conf*** 3. Add the following line (spaces are not allowed): ***sim_ipsec_dont_fragment=1*** 4. If needed, add the additional parameters to fine-tune the new behavior. 5. Save the changes in the file and exit from Vi editor. 6. Check the configuration file: ***\[Expert@HostName\]# cat $PPKDIR/boot/modules/simkern.conf*** 4. Reboot the Security Gateway / each cluster member.

* **Show / Hide instructions for R77 and lower** **Note:** In cluster environment, this procedure must be performed on *all* members of the cluster. 1. [Contact Check Point Support](http://www.checkpoint.com/services/contact/index.html) to get a Hotfix for this issue. A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix. For faster resolution and verification, please collect [CPinfo files](http://supportcontent.checkpoint.com/solutions?id=sk92739) from the Security Management Server and Security Gateways involved in the case. 1. Hotfix has to be installed on **Security Gateway / each cluster member**. 2. Transfer the hotfix package to the machine (into some directory, e.g., */some_path_to_fix/*). 3. Unpack and install the hotfix package: ***\[Expert@HostName\]# cd /some_path_to_fix/*** ***\[Expert@HostName\]# tar -zxvf sim_\.tgz*** ***\[Expert@HostName\]# ./sim_\*** Note: The script will stop all the Check Point services (*cpstop*) - read the output on the screen. 4. Do NOT reboot yet. 2. Enable the new fragmentation SecureXL behavior - set the value of new SecureXL kernel parameter ***sim_ipsec_dont_fragment*** to 1 (one): 1. Create the relevant configuration file if it does not already exist: ***\[Expert@HostName\]# touch $PPKDIR/boot/modules/simkern.conf*** By default, the file should be created with permissions "`rw`" and should belong to "`admin:root`". *Example* : ``` [Expert@MyFW:0]# ls -l $PPKDIR/boot/modules/simkern.conf -rw-rw---- 1 admin root 0 Feb 19 13:29 /opt/CPppak-R77/boot/modules/simkern.conf [Expert@MyFW:0]# ``` 2. Edit the configuration file: ***\[Expert@HostName\]# vi $PPKDIR/boot/modules/simkern.conf*** 3. Add the following line (spaces are not allowed): ***sim_ipsec_dont_fragment=1*** 4. If needed, add the additional parameters to fine-tune the new behavior. 5. Save the changes in the file and exit from Vi editor. 6. Check the configuration file: ***\[Expert@HostName\]# cat $PPKDIR/boot/modules/simkern.conf*** 3. Reboot the Security Gateway / each cluster member. (III) Related solutions: ------------------------ * [sk98074 - MTU and Fragmentation Issues in IPsec VPN](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98074) * [sk98722 - ATRG: SecureXL](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk98722) --- # Agent Instructions This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products. ## Navigating This Knowledge Base - **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt) - **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml) - **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}` - **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content