Question about ack attack and Kerio Firewall

I get the same messages from my Check Point 500W UTM appliance. It was explained on Check Point's discussion group that information may be purged from the state table, prematurely, and this is why it occurs. Here is the broken English response, direct from Sofaware:

"Packets coming from the internal network should be indeed allowed (depending on the security policy) however, they must stand certain criterias like getting TCP ACKs within a certain time interval. If this condition is not fulfilled, the appliance will send a RESET packet, erase the connection from the state table and log the connection as Syn attack. If for some reason the client or server behind the box did not comply to this scenario, then you'll the log. BTW, the Safe@Office appliances behaved like that forever, only without logging..."

This may be what's happening in your case, as well. Sounds like something not to be too concerned with.

I have heard that it's just nonsense and you should ignore it. Turn that option off (log suspicious packets) and you won't see it anymore.

OK, thanks. I've been monitoring the ports and there's nothing suspicious going on so I think you are right.

OK, thank you.