Novell NCP dropped by fw

[dr-spoof]

I have a customer who is running Novell NCP via thier firewall and a lot instability and login failures is occuring.

It appears that the hosts continue to send syn packets and Check Point is dropping them because the connection already exisits at least Check Point says so.

th_flag 2 message_info SYN packet for established connections"

This is going on all the time. Check Point hasn't offered a fix , and the only thing I could fiind was to turn down the TCPendtimeout to 10. This had no effect at all. I see thousands of these in the log, in fact there are more drops on the syn message then allowed by the rule.

Anyone see this, or fixed it?

Thanks.