Security Gateway does not decrease TTL in packets that go through SecureXL Medium Path

Product: SecureXL
Version: R81.10 (EOS), R81.20, R82
OS: Gaia
Last Modified: 2026-02-18

Symptoms

• Traffic capture with FW Monitor (sk30583) or CPPCAP (sk141412) on the Security Gateway shows that the Time To Live (TTL) value does not decrement in some packets.

Cause

When the Security Gateway R81.20 and R82 processes traffic in the Medium Path (as required by specific Software Blades), the Security Gateway may fail to decrement the TTL value in the packets.

Medium Path (PXL) is a packet flow when the packet is handled by the passive streaming layer, except for:

• IPS (some protections)
• VPN (in some configurations)
• Application Control
• Content Awareness
• Anti-Virus
• Anti-Bot
• HTTPS Inspection
• HTTP/HTTPS Proxy mode
• Mobile Access
• VoIP
• Web Portals for Software Blades

Solution

This problem was fixed. The fix is included in:

• Check Point Quantum R82.10
• Jumbo Hotfix Accumulator for R82 starting from Take 73
• Jumbo Hotfix Accumulator for R81.20 starting from Take 122
• Jumbo Hotfix Accumulator for R81.10 starting from Take 183

If you choose not to upgrade, Check Point can supply a Hotfix. Contact Check Point Support to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect CPinfo files from the Security Management Server and Security Gateways involved in the case.

Hotfix installation instructions:

Refer to sk168597 - How to install a Hotfix.

Article Properties

Access Level: General
Status: Approved
Date Created: 2025-08-11
Last Modified: 2026-02-18