|
Timing is critical in state table
synchronization.
It's also time sensitive, that is, the NTP
setting of the firewalls in Voyager
or Lynx needs to point to the same time
source. Use
Stratum 2 time source.
State table syncrhonization occurs every 100ms and
can last up to 55ms.
In version 4.1, you can create a file that limits what is
synchronized so that
selected protocols that connect and disconnect frequently,
like DNS (UPD), HTTP,
and IDENT are NOT syncrhonized.
Check out this link
for more information.
Make sure you are using a dedicated cross-over cable between
the two
firewalls running at 100MBps and setup as a private network (10.x, 172.16, or
192.168).
If all this is true, then when you perform the fw tab -s -t connections,
the
numbers between the primary (active) and secondary (standby) firewalls
will
be nearly the same, +-100 connections. The secondary will normally be
slightly
behind the primary since the pimary is the one creating and
synchronizing
the firewalls.
David C. Diemer, CCSE Enterprise Security Firewall Engineer Georgia
Department of Administrative Services (DOAS) 200 Piedmont Ave. SE Suite
1420, West Tower Atlanta, GA 30334 [email protected](V) (F) >>> < [email protected]> 03/28/01 09:25AM
>>> To: fw-1-mailinglist Update: This
is the theory. We are surmising ,by the amount of 2 way traffic on the state
sync net, that the Slave (backup) firewall is timeing out the connections in
its state tables and sending/sharing that time out information with
the Master FW. This of course is VERY bad. This is in ref. to our
issues with a couple o pairs of Nokia 440's running VRRP and state sync.
(IPSO 3.3/CP 4.1 sp3) sync.conf now only has the IP address of its
peer. peers are connected with a crossover cable, show as connected and
enabled using all tools to ascertain. Fail over does work. We simply
cannot keep UDP connections up at all and TCP connections that last for any
length of time are having issues as well. Any ideas on how to avoid this
goofy slave timeing out of connection issue or is this a "feature" in Nokia's
Checkpoint solution. (I sure hope not)!!!!!!!!!!!!!!!!!!!!!!!! Bring
on the
ideas/questions Howard ================================================================================
To unsubscribe from this mailing list, please see the instructions
at
http://www.checkpoint.com/services/mailing.html================================================================================ | 
