topic Re: Disabling bad checksum on Firewalls in General Topics

Disabling bad checksum on Firewalls

Abhishekc — Thu, 22 Jul 2021 06:25:00 GMT

Hi All,

We have received an request to disable the drop of packets due to bad checksum. I had the following questions on this:

Q1: Can i see in the traffic logs if any connections are dropped due to bad checksum.

Q2: This can be done by entering the following command through CLI

set session strict-checksum no

Is this correct? Will it have any impact on the overall functioning of firewall.

Re: Disabling bad checksum on Firewalls

reaper — Thu, 22 Jul 2021 17:40:35 GMT

A) you can only see those drops though global counters, they will not show on traffic logs

B) correct, that command will disable the checksums. It should not have an impact on global traffic, it will simply disable the security check

Re: Disabling bad checksum on Firewalls

BPry — Thu, 22 Jul 2021 17:47:35 GMT

@Abhishekc,

This would only be recorded in the interface counters as far as I'm aware, it'll never actually get recorded in the traffic logs. The command you are using is correct set session strict-checksum no will disable validation of TCP and IP checksum.

What you are doing with this command isn't necessarily going to cause any ill-effects, however it really shouldn't need to be done in most situations. It won't cause any issues to other traffic if done however; your just going to be processing traffic that amy be corrupt.

Re: Disabling bad checksum on Firewalls

randall9587 — Fri, 23 Jul 2021 09:32:53 GMT

This for update, really well for me, thank you! have same question here.

Help is appreciated.

Re: Disabling bad checksum on Firewalls

Alen_Bilich — Wed, 09 Apr 2025 04:03:01 GMT

is it possible to permit TCP checksum from certain source ip's and drop the rest?