NETWORK PRESENCE ABOUT SERVICES PRODUCTS TRAINING CONTACT US SEARCH SUPPORT
 


Search
display results
words begin  exact words  any words part 

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [FW1] Hypothesis: State Sync Nokia/UDP





Howard:

     Do you have "Flows" enabled? Currently there is an issue with IPSO 3.3
(with Flows) and CheckPoint FW-1 4.1SP2/3 in the way that IPSO interacts with
the FW-1 state table.

     You can find out whether "Flows" is enabled by performing the following
command:

          ipsofwd list

     If you see a line such as the following:

          net:ip:forward:switch_mode = fastpath

     then "Flows" is enabled.


     Try disabling "Flows" on both FWs to see if this does not help.

     I am assuming that you have access to the Nokia support site? Take a look
at KB articles #5034 and 4188. Though both of the articles only mention TCP
stuff I would imagine that UDP might also be exhibiting the same behaviour.

     Good luck. If there is anything else I can do to help let me know.


|--------+----------------------->
|        |          Howard_Bunzey|
|        |          @idx.com     |
|        |                       |
|        |          03/28/2001   |
|        |          08:25 AM     |
|        |                       |
|--------+----------------------->
  >----------------------------------------------------------------------------|
  |                                                                            |
  |       To:     [email protected]                     |
  |       cc:     (bcc: James E Clukey/Rush/RSH)                               |
  |       Subject:     [FW1] Hypothesis: State Sync Nokia/UDP                  |
  >----------------------------------------------------------------------------|







To:   fw-1-mailinglist
Update:

This is the theory. We are surmising ,by the amount of 2 way traffic on the
state sync net, that the Slave (backup) firewall is timeing out the connections
in its state tables and sending/sharing that time out information with the
Master FW. This of course is VERY bad.

This is in ref. to our issues with a couple o pairs of Nokia 440's running VRRP
and state sync. (IPSO 3.3/CP 4.1 sp3)

sync.conf now only has the IP address of its peer.

peers are connected with a crossover cable, show as connected and enabled using
all tools to ascertain. Fail over does work.

We simply cannot keep UDP connections up at all and TCP connections that last
for any length of time are having issues as well.

Any ideas on how to avoid this goofy slave timeing out of connection issue or is
this a "feature" in Nokia's Checkpoint solution. (I sure hope
not)!!!!!!!!!!!!!!!!!!!!!!!!

Bring on the ideas/questions

Howard




================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================





================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================



 
----------------------------------

ABOUT SERVICES PRODUCTS TRAINING CONTACT US SEARCH SUPPORT SITE MAP LEGAL
   All contents © 2004 Network Presence, LLC. All rights reserved.