In some cases operating systems while creating new connection might reuse the source port. That might cause problems in cases where the previous connection in the firewall hasn’t been closed yet. In other words you still have the same source/destination IP address:Port combination already in connection table and the firewall will drop it with the reason that it’s a SYN packet in a already existing connection.

To resolve that issue instead of just waiting for the connection to time out you can remove the connection from the connections table.  To do that you must log in to the firewall CLI and get the whole connections table in to a file, then generate the relevant delete commands. I wish it was easier, but CheckPoint keeps it’s connection table info in HEX and requires the delete command also to have the connection info in HEX.

So the procedure it self needs to be done in the “Expert Mode” and it goes as follows:
1) Get the connections table in to a file

[Expert@cplab]# fw tab -t connections -u > connections.txt

2) Generate delete commands for all the connections between the source and destination IP addresses:

[Expert@cplab]# IPA=""; IPB=""; IPAHEX=`printf '%02x' ${IPA//./ }`; IPBHEX=`printf '%02x' ${IPB//./ }`; grep "$IPAHEX" connections.txt | grep "$IPBHEX" | grep "^<0000000" | awk  '{print $1" "$2" "$3" "$4" "$5" "$6}'|sed 's/ //g'|sed 's/</fw tab -t connections -x -e /g'|sed 's/>//g'|sed 's/;//g' >

3) Run the script generated in the previous command. (I prefer using the -x flag to see the actual commands being run)

[Expert@cplab]# sh -x
+ fw tab -t connections -x -e 00000000,c0a80137,000002c8,c0a8021b,0000037c,00000011
Entry <00000000, c0a80137, 000002c8, c0a8021b, 0000037c, 00000011>
deleted from table connections

And after that all the connections between the selected 2 hosts should have been deleted. I you want to be more specific you can actually add also port numbers to the mix.

This post is based on the article found I at and is just a reminder for my self so I wouldn’t have to go through the community and support sites looking for it.