sk181921 - Messages logs showing "kernel: [SIM4];pkt_handle_f2v_if_needed: dropping packet (failed to send notification), conn:"

Messages logs showing "kernel: [SIM4];pkt_handle_f2v_if_needed: dropping packet (failed to send notification), conn:"

Product: SecureXL
Version: R81 (EOS), R81.10 (EOS)
Last Modified: 2024-07-01

Symptoms

Cause

The queue fwmultik_pending_queue_len_limit exceeded its designated threshold, attributed to an excessive number of f2v connections. To rectify the situation and address the leakage in the gconn table, a necessary Hotfix involves augmenting the queue limit.

Solution

This problem was fixed. The fix is included in:

The hotfix adds the ability to increase the queue size, by modifying the kernel parameter 'fwmultik_pending_queue_len_limit' (default value 2000).

In addition, the following kernel parameters can be increased:

  1. fwmultik_input_queue_len (default value 2048)
  2. fwmultik_prio_queue_len_limit (default value 512)
  3. fwmultik_prio_conn_token_limit (default value 128)

It is suggested to increase these gradually by doubling the values.

Please refer to sk26202: Changing the kernel global parameters on Check Point Security Gateways.

If you choose not to upgrade, Check Point can supply a Hotfix. Contact Check Point Support to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect CPinfo files from the Security Management Server and Security Gateways involved in the case.

Hotfix installation instructions:

Refer to sk168597 - How to install a Hotfix.

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

Article Properties