[EMAIL PROTECTED] wrote: > > Greetings, > > Have a pair of Nokia 650's w/VRRP running on the outside of our site purely to > terminate VPN tunnels with partner companies. They are configured "on a stick", > i.e. the encrypted traffic enters the public interface, gets decrypted, and leaves > the public interface again, headed towards the PIX that actually protects the > application segment. > > I noticed this morning that there is a flood of ICMP redirects streaming out of both > Nokias. It appears that for every packet coming out of our application segment > destined for something on the other side of a tunnel a redirect is sent from the > Nokia to the app server, asking it to use the border router instead. Now the border > router is the default gateway for the Nokias and also for the PIX. It makes some > sense that the Nokia would complain about being "in the middle", and if the traffic > was not meant for a tunnel it would be a needless hop. I would assume that if I > could make some static route entries for the destinations on the other side of the > tunnels I could squelch this redirect flood, but because it is "on a stick" I don't > have another interface to direct the traffic to! > > Despite all of this the traffic DOES enter the tunnel as intended, and the > application is operating normally (other than complaints about it being slow, which > is what began the investigation this morning that uncovered the redirects). > > First I am wondering if this is a normal artifact of configuring this to run "on a > stick",
As others have pointed out, this is the correct behavior for these machines. > and second I am wondering if it is possible that these redirects are slowing down > the traffic in any way. It's definately possible. It doubles the packet count on the link after all. But if you're bandwidth and CPU are underutilized, that may or may not be a problem. > Finally I would love to hear from someone that has solved this :) > > Any ideas? Well, the Nokias are FreeBSD based, so you can go looking for the 'net.inet.ip.redirect' sysctl(8) knob and set it to 0. The other option is to logically partition the Nokias' idea of the network. However, that might be quite painful in a VRRP situation. -- Crist J. Clark [EMAIL PROTECTED] Globalstar Communications (408) 933-4387 The information contained in this e-mail message is confidential, intended only for the use of the individual or entity named above. If the reader of this e-mail is not the intended recipient, or the employee or agent responsible to deliver it to the intended recipient, you are hereby notified that any review, dissemination, distribution or copying of this communication is strictly prohibited. If you have received this e-mail in error, please contact [EMAIL PROTECTED] ================================================= To set vacation, Out Of Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
