[FW-1] IPSO 3.7 Cluster with NG AI and HTTP Problems

[André Münch <andre.muench@FW1-NOSPAMEPOST.DE>]

Hi,

i have 2 Nokia IPs running IPSO 3.7 with IPSO Clustering and Checkpoint NG AI with Cluster Objects 3th Party-Configuration "NOKIA IPSO Clustering".
Synchronisation (2 Sync-Nets) seems to work fine. The Nokia-Cluster works in "Forewarding Mode". Pinging as well as FTP to the Internet work. HTTP won´t
work. I analyzed the traffic. The HTTP return packets arrived at the external interface but weren´t forwarded to the internal interface ...black hole -effect :-(( ! There are no drops in the Log. As soon as i remove 1 Nokia from the Cluster HTTP works. Bringing it back in to the Cluster stops HTTP working. I found the Nokia Resolution 15201 wich addresses an issue for NG FP3 ONLY which looks a bit like my problem. I tried this workaround..and ...HTTP works. Unfortunately, when using this resolution,  the Management Server issues for every Cluster-Interface a few warning-messages and states finaly that VPN won´t work properly in this configuration. When installing the policy there are no further warnings or errors.

Any ideas?

André


=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to LISTSERV@amadeus.us.checkpoint.com
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
fw-1-owner@ts.checkpoint.com
=================================================