Troubleshooting Tips
From Tech-Wiki
More actions
Check Point troubleshooting checklist retained with a safety overlay.
Validation status
Reviewed for migration on 27 September 2026. Read-only observation should precede disabling security functions, clearing state or restarting services.
Some legacy steps are disruptive
Commands that disable IPS/SecureXL, remove a cluster member, stop services, reboot, unload policy or clear live connection state require explicit change control.
Original technical reference
If you are facing strange behavior, in an advanced/illogic scenario, evaluate/review the following items in this order:
- Policy
- NAT (correct NAT mode? Does it require manual proxy arp?)
- Routing
- Anti-spoofing (even from return packet, check logs in opposite direction)
- VPN Encryption domain (for your and remote peer)
- IPS (Use command: ips off)
- Connection Limit (fw ctl pstat)
- Disable SecureXL (Use command: fwaccel off)
- Test in the other cluster member (Use command: clusterXL_admin down –p)
- Issue a cpstop/cpstart or reboot
- Consider installing the latest Jumbo hotfix accumulator or Recommended Hotfixes (per sk106162 and sk106389)
- Did I forget something?!
- That’s probably a bug, raise a TAC
Confirm the reason of your packet being dropped using:
fw ctl zdebug + drop | grep 'x.x.x.x\|y.y.y.y'
If log is stuck with existing old sessions (no new logs, or still showing traffic from previous policies), clear connection's table:
fw tab -t connections -x