[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [FW1] Hypothesis: State Sync Nokia/UDP
Howard: Do you have "Flows" enabled? Currently there is an issue with IPSO 3.3 (with Flows) and CheckPoint FW-1 4.1SP2/3 in the way that IPSO interacts with the FW-1 state table. You can find out whether "Flows" is enabled by performing the following command: ipsofwd list If you see a line such as the following: net:ip:forward:switch_mode = fastpath then "Flows" is enabled. Try disabling "Flows" on both FWs to see if this does not help. I am assuming that you have access to the Nokia support site? Take a look at KB articles #5034 and 4188. Though both of the articles only mention TCP stuff I would imagine that UDP might also be exhibiting the same behaviour. Good luck. If there is anything else I can do to help let me know. |--------+-----------------------> | | Howard_Bunzey| | | @idx.com | | | | | | 03/28/2001 | | | 08:25 AM | | | | |--------+-----------------------> >----------------------------------------------------------------------------| | | | To: [email protected] | | cc: (bcc: James E Clukey/Rush/RSH) | | Subject: [FW1] Hypothesis: State Sync Nokia/UDP | >----------------------------------------------------------------------------| To: fw-1-mailinglist Update: This is the theory. We are surmising ,by the amount of 2 way traffic on the state sync net, that the Slave (backup) firewall is timeing out the connections in its state tables and sending/sharing that time out information with the Master FW. This of course is VERY bad. This is in ref. to our issues with a couple o pairs of Nokia 440's running VRRP and state sync. (IPSO 3.3/CP 4.1 sp3) sync.conf now only has the IP address of its peer. peers are connected with a crossover cable, show as connected and enabled using all tools to ascertain. Fail over does work. We simply cannot keep UDP connections up at all and TCP connections that last for any length of time are having issues as well. Any ideas on how to avoid this goofy slave timeing out of connection issue or is this a "feature" in Nokia's Checkpoint solution. (I sure hope not)!!!!!!!!!!!!!!!!!!!!!!!! Bring on the ideas/questions Howard ================================================================================ To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================================================ ================================================================================ To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================================================
|