TCP packets are not forwarded out of a Bridge interface when SecureXL is on

Product: Security Gateways
Version: R81.20, R82, R82.10
Last Modified: 2026-07-23

Symptoms

• TCP connections cannot be established for traffic traversing a bridge interface when SecureXL is enabled.
• ICMP traffic works as expected.
• Packet captures show that after traffic passes through the bridge interface, the VLAN tag is removed, and the destination and source MAC addresses are incorrect.
• TCP connectivity is restored when SecureXL is disabled or after switching SecureXL from UPPAK mode to KPPAK mode.

Cause

This behavior occurs due to a software condition in the handling of VLAN-tagged traffic in Bridge Mode when SecureXL processes traffic in UPPAK mode. This condition affects Medium Path traffic processing, which results in incorrect packet modification.

Solution

This problem was fixed. The fix is included in:

• Jumbo Hotfix Accumulator for R82.10 starting from Take 36

If you choose not to upgrade, Check Point can supply a Hotfix. Contact Check Point Support to get a Hotfix for this issue. A Support Engineer will make sure the Hotfix is compatible with your environment before providing the Hotfix.

For faster resolution and verification, please collect CPinfo files from the Security Management Server and Security Gateways involved in the case.

Hotfix installation instructions:
Refer to sk168597 - How to install a Hotfix.

NOTE

This solution has been verified for the specific scenario, described by the combination of Product, Version and Symptoms. It may not work in other scenarios.

Article Properties

Access Level: General
Status: Approved by TAC
Date Created: 2026-07-06
Last Modified: 2026-07-23