Re: [FW-1] NG FP1 and retaining connections on rulebase reload

[Don <don@FW1-NOSPAMBLACKSUN.ORG>]

> Basically that if I reload an existing policy (with a slight tweak to
> an unrelated rule), then the connection table will be flshed; the
> reason I suspect this is that after getting the usual control messages
> in the log that a new reulebase is in, I start gettting a lot of out
> of state entries for various connections in the log. The messages are
> pertaining to connections that were alive before the reload. Likewise,
> any SSH connections to the filter nodes themself will be locked upand
> dead after reloading.
That slight tweak may be causing more problems that you realize. I am
running NG on several boxes and have never seen it flush the connection
table after a policy reload.

As for out of state connections, well, those seem to show up everywhere
with NG anyway.

-Don

=================================================
To set vacation, Out Of Office, or away messages,
send an email to LISTSERV@lists.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================