[FW1] log authentication problem - urgent please help

["Peter Schwalger" <pschwalger@FW1-NOSPAMjade.co.nz>]

I had to swap out the hardware on my pfm (Checkpoint 3.0b SP9 - NT4 SP5) so
rebuilt a newer machine with the same NIC cards etc and all went well except
that I cant get it to log back to the master.

Snmp is okay, I can install a policy from the master to the pfm fine but
just cant get the logging going back to the master.
I can see the remote pfm is logging locally, so I copied the fw.log file to
the master and opened it with the gui.
I noticed straight away that the new firewall is somehow using a different
NIC (and ip address as the origin). The interface it is using is no longer
the internal interface which is closest to the master and I can also see the
same ip address and log authentication failure in the NT event log on the
master.

Can anyone tell me why it would use a different interface for logging?

The internal interface is the one that Checkpoint is licensed against and it
is the ip address in the general tab on the firewall object which I load the
policy to.

Is there a fix or workaround - I have tried playing with fwputkeys etc but
as I built the new platform and configured it the same I cant see how the
firewall decides which address it uses for redirecting the log.

Thanks in anticipation....Peter.



================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================