[FW1] Hypothesis: State Sync Nokia/UDP

[Howard_Bunzey@FW1-NOSPAMidx.com]

To:   fw-1-mailinglist
Update:

This is the theory. We are surmising ,by the amount of 2 way traffic on the
state sync net, that the Slave (backup) firewall is timeing out the connections
in its state tables and sending/sharing that time out information with the
Master FW. This of course is VERY bad.

This is in ref. to our issues with a couple o pairs of Nokia 440's running VRRP
and state sync. (IPSO 3.3/CP 4.1 sp3)

sync.conf now only has the IP address of its peer.

peers are connected with a crossover cable, show as connected and enabled using
all tools to ascertain. Fail over does work.

We simply cannot keep UDP connections up at all and TCP connections that last
for any length of time are having issues as well.

Any ideas on how to avoid this goofy slave timeing out of connection issue or is
this a "feature" in Nokia's Checkpoint solution. (I sure hope
not)!!!!!!!!!!!!!!!!!!!!!!!!

Bring on the ideas/questions

Howard




================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================