Traffic is dropped with "dropped by fwmultik_process_f2p_cookie_inner Reason: fwmultik_f2p_cookie_outbound_and

Support Center > Search Results > SecureKnowledge Details

Traffic is dropped with "dropped by fwmultik_process_f2p_cookie_inner Reason: fwmultik_f2p_cookie_outbound_and_routing failed;"

Technical Level

Solution ID	sk167953
Technical Level
Product	SecureXL
Version	R80.30, R80.20
OS	Gaia
Platform / Model	AWS
Date Created	13-Jul-2020
Last Modified	21-Dec-2020

Symptoms

When secureXL is enabled on the Security Gateway, traffic is dropped with the following error in kernel debug (fw ctl zdebug drop):
"dropped by fwmultik_process_f2p_cookie_inner Reason: fwmultik_f2p_cookie_outbound_and_routing failed;".
MTU on a device between source and destination has MTU higher that 1500. Checkpoint has MTU set to 1500.
Disabling secureXL solves the issue.
Setting MTU to 9001 on CheckPoint also solves the issue.

Cause

The PMTUD tries to find the optimal MTU in all the path between the client and the server by sending large MTU with DF flag, every node in the path that can accept only smaller MTU sends ICMP fragmentation needed with its acceptable MTU. The ICMP message is not sent properly.

Solution

Note: To view this solution you need to Sign In .