| |
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [FW-1] FW-1-MAILINGLIST Digest - <first ever> to 5 Oct 2001 (#2001-1)
- To: [email protected]
- Subject: Re: [FW-1] FW-1-MAILINGLIST Digest - <first ever> to 5 Oct 2001 (#2001-1)
- From: Terry Daus <[email protected]>
- Date: Sun, 7 Oct 2001 21:03:57 -0700
- Comments: To: Mailing list for discussion of Firewall-1 <[email protected]>
- Reply-to: Mailing list for discussion of Firewall-1 <[email protected]>
- Sender: Mailing list for discussion of Firewall-1 <[email protected]>
- Thread-index: AcFON6Tctdz0g3xmSiSaR0ef4sQ2ewBdEmiA
- Thread-topic: FW-1-MAILINGLIST Digest - <first ever> to 5 Oct 2001 (#2001-1)
To: [email protected] - still having NAT problems.
Back in your original email you snuck in the middle of the NAT tables
this line...
> > > And it's obviously installed on FW1 cluster.
----------------------------------------------------------------------
Are you really using the cluster object? If so, what are you using to
do the failover? If it is Nokia, then the MAC address ARP for under NAT
needs to be the MAC associated with the VRRP address of the external
interface. The other options (Check Point, Stonegate, etc...) all have
ways of designating the MAC of the external interface, which is what you
should be using so that your NAT fails over also.
Also, is there anything in the Info column in the Log Viewer when you
get these Rule 0 drops?
Last, try turning off SynDefender - I don't have a known error, but I
have seen it cause problems recently since 4.1 SP4.
Yours
Terry Daus, CCSI
BMD Solutions, Inc.
================================================================================
To unsubscribe from this mailing list, please see the instructions at
http://www.checkpoint.com/services/mailing.html
================================================================================
|
|
