Re: [FW-1] NG FP3 New HA Cluster Question

[Ted Serreyn <ted@FW1-NOSPAMSERREYN.COM>]

What type of hardware is this running on?


If you truly are running clustering on a nokia and not VRRP HA, then you
will not be able to ping the Virtual addresses.  This is, IMHO, a major
problem with running clustering in the current generation of the ipso
based clustering.

Ted Serreyn


>
> I have a NG FP3 HA cluster (not load-sharing) internal to the LAN not doing
> NAT, just packet-filtering. Should I be able to ping both cluster IP's?
> etc. see below:
>
> 1st side
> Cluster IP - 10.0.0.1
> Firewall 1 - 10.0.0.2
> Firewall 2 - 10.0.0.3
>
> 2nd side
> Cluster IP - 192.168.1.1
> Firewall 1 - 192.168.1.2
> Firewall 2 - 192.168.1.3
>
> Sometimes I can only ping the interfaces of Firewall 1 and the Cluster IP's
> Sometimes I can only ping the interfaces of Firewall 1 and Firewall 2 but
> not the Clutser IP's
>
> SmartView Status reports everything fine, and shows Firewall 1 as active
> and Firewall 2 as standy.
> Ive worked with many other vendors firewall clusters and I could always
> ping all interfaces and cluster IP's.

--
Ted Serreyn
Serreyn Network Services, LLC
http://www.serreyn.com/

=================================================
To set vacation, Out Of Office, or away messages,
send an email to LISTSERV@lists.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================