Anti-Spoofing drops IPv6 traffic that arrives at an interface with an IPv6 address configured

Product: Security Gateways
Version: R81.10 (EOS), R81.20, R82
OS: Gaia
Platform: Open Server
Last Modified: 2025-01-27

Symptoms

• Anti-Spoofing drops IPv6 traffic that arrives at an interface with an IPv6 address configured. The logs show:

  @;272246227;[kern];[tid_37];[SIM-241695243];sim_pkt_send_drop_notification: sending single drop notification, conn: <2001:b68:ff:12:4605:4035:f5a0:1867,6,fdca:0:0:2:0:0:32:2,128,58>;
  @;272246227;[kern];[tid_37];[SIM-241695243];do_packet_finish: SIMPKT_IN_DROP vsid=2, conn:<2001:b68:ff:12:4605:4035:f5a0:1867,6,fdca:0:0:2:0:0:32:2,128,58>;
  @;37145111;[vs_2];[tid_0];[fw6_0];cphwd_notif_packet_dropped: received packet dropped notification, reason: Anti-Spoofing;
  @;37145111;[vs_2];[tid_0];[fw6_0];cphwd_notif_packet_dropped: notification holds a single drop;
  

Cause

The IPv6 addresses were miscalculated when exceptions were added from the external interface.

Solution

This problem was fixed. The fix is included in:

• Jumbo Hotfix Accumulator for R82 starting from Take 10
• Jumbo Hotfix Accumulator for R81.20 starting from Take 90
• Jumbo Hotfix Accumulator for R81.10 starting from Take 171

If you choose not to upgrade, Check Point can supply a Hotfix. Contact Check Point Support to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect CPinfo files from the Security Management Server and Security Gateways involved in the case.

Hotfix installation instructions:

Refer to sk168597 - How to install a Hotfix.

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.