The best way to test this would obviously be to turn off redirects on the Nokias. I have seen the opposite scenario, where people wanted to turn ON redirects, and required a recompiled version of a Checkpoint executable (fw.exe I believe). I'm not sure if they would do the reverse for the Nokia platform, but it's certainly worth contacting them.
Mike Feetham -----Original Message----- From: Mailing list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED] On Behalf Of [EMAIL PROTECTED] Sent: Wednesday, March 12, 2003 6:52 AM To: [EMAIL PROTECTED] Subject: [FW-1] Nokia ICMP redirects Greetings, Have a pair of Nokia 650's w/VRRP running on the outside of our site purely to terminate VPN tunnels with partner companies. They are configured "on a stick", i.e. the encrypted traffic enters the public interface, gets decrypted, and leaves the public interface again, headed towards the PIX that actually protects the application segment. I noticed this morning that there is a flood of ICMP redirects streaming out of both Nokias. It appears that for every packet coming out of our application segment destined for something on the other side of a tunnel a redirect is sent from the Nokia to the app server, asking it to use the border router instead. Now the border router is the default gateway for the Nokias and also for the PIX. It makes some sense that the Nokia would complain about being "in the middle", and if the traffic was not meant for a tunnel it would be a needless hop. I would assume that if I could make some static route entries for the destinations on the other side of the tunnels I could squelch this redirect flood, but because it is "on a stick" I don't have another interface to direct the traffic to! Despite all of this the traffic DOES enter the tunnel as intended, and the application is operating normally (other than complaints about it being slow, which is what began the investigation this morning that uncovered the redirects). First I am wondering if this is a normal artifact of configuring this to run "on a stick", and second I am wondering if it is possible that these redirects are slowing down the traffic in any way. Finally I would love to hear from someone that has solved this :) Any ideas? Thanks, Jeff LaCoursiere Infrastructure Specialist T-Mobile International UK ================================================= To set vacation, Out Of Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out Of Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
