TCP-RST

[Buka Jorbenadze]

Hello

I have a Check-Point virtual firewall in the network, connected to  router, with a 0.0.0.0 route pointing towards the router. When the Check-Point needs to update, it  traffic through the router, which performs NAT to an external IP. 

Now, the issue is as follows: I captured traffic on the router and observed returned packets with RST. The source is 1.1.11.1 and the destination IPs are shown in the screenshot. Additionally, at certain moments, updates are partially downloaded—some files are retrieved, but then the connection stops and resets.

I suspect the issue might be related to the router. This capture  take from   router's interface.

I am also sharing the command executed from the Check Point server, which failed to complete successfully.

thanks 

[MHM Cisco World]

TCP-RST can cause of Asymmetric you point the traffic toward the router but the retrun traffic is still come toward FW

MHM 

[Buka Jorbenadze]

Where would the asymmetry occur? The outgoing and incoming  interfaces on the firewall are the same

[MHM Cisco World]

you redirect traffic to router, am I correct ?

[Buka Jorbenadze]

Yes, I am sending  update traffic from the Check Point, and it goes to the router, then  returned traffic enters the router and goes to the Check Point and this  capture i took it from the router.

[MHM Cisco World]

tcp.flags.reset == 1 <<- use this to filter and disaply only rest packet 
then add new column TTL let see which TTL appear for above filter packet 

MHM

[Buka Jorbenadze]

[MHM Cisco World]

win=0 
the client buffer is full that why no ACK and packet need to re transmit 

check bug and windows scale op in both clinet and server 

MHM

[Flavio Miranda]

@Buka Jorbenadze 

 It does not make sense. The command you ran on CheckPoint is trying to connect on port 80. You had one success and one fail attempt. 
 The log you collected from router is HTTPS traffic, port 443.  For me, it is not the same traffic. 
who have the IP address 1.1.11.1 ?

[Buka Jorbenadze]

I think this traffic is difference not for update Server, The checkpoint IP address is 1.1.11.1

[Flavio Miranda]

If the CheckPoint have the IP address 1.1.11.1 then the check point sent the reset when the IP address on the internet tried to communicate on port 443 with CP.

Make sure you have rule allowing this traffic coming from the internet.