Re: [FW-1] HA - UDP 8116

[Torkel Mathisen <Torkel.Mathisen@FW1-NOSPAMERGO.NO>]

The purpose of udp 8116 is first to allow each HA cluster
member to check if the other HA members are up and second
to verify interface status.

This traffic can ble safely ignored according to CP. (I hate
that kind of "sollution")

You can't allow, disable or don't log it because the CPHA
(which sends the udp 8116 traffic) is located between the
FW-1 kernel and the NIC. There is no way the Security Policy
can block the traffic.

The only way to prevent it is to disable CPHA in the cpconfig
menu on your gateways. But I guess thats not such a good idea.
:)

Regards,
Torkel

> -----Original Message-----
> From: Boutros [mailto:boutros70@YAHOO.COM]
> Sent: 3. februar 2003 20:07
> To: FW-1-MAILINGLIST@beethoven.us.checkpoint.com
> Subject: [FW-1] HA - UDP 8116
>
>
> Hello,
>
> Working in a Check Point HA cluster environment,
> version 4.1 SP6, newly installed.
>
> The logs are full of entries for UDP/8116, origin=
> 10.10.10.10 - the firewall, source=10.10.10.0
> (network), dest = 10.10.10.10, 4 entries dropped per
> second.
>
> Only on the active machine.  When I fail over, the new
> active machine does the same thing.
>
> According to IANA, this port is "Check Point
> Clustering".  There is no service defined for this in
> the Check Point GUI.
>
> Question is, what is its purpose?  It's currently
> being dropped by the stealth rule - and HA works fine.
>
> I'd like to allow it if necessary, disable it if
> possible, or, if not, set up a rule to get it out of
> my logs.
>
> TIA.
>
>
>
> __________________________________________________
> Do you Yahoo!?
> Yahoo! Mail Plus - Powerful. Affordable. Sign up now.
> http://mailplus.yahoo.com
>
> =================================================
> To set vacation, Out Of Office, or away messages,
> send an email to LISTSERV@lists.us.checkpoint.com
> in the BODY of the email add:
> set fw-1-mailinglist nomail
> =================================================
> To unsubscribe from this mailing list,
> please see the instructions at
> http://www.checkpoint.com/services/mailing.html
> =================================================
> If you have any questions on how to change your
> subscription options, email
> fw-1-owner@ts.checkpoint.com
> =================================================
>

=================================================
To set vacation, Out Of Office, or away messages,
send an email to LISTSERV@lists.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================