Hi,
On Fri, 2003-06-06 at 01:00, Paleologus, Tony wrote:
> I've setup two Nokia IP440's w/IPSO 3.6 FCS6 and FW-1/VPN-1 NG FP3 HF2. I've
> configured one FE card to be the in/out using two VLANs. They use VRRP (on
> different vrouter #'s) and work fine. I setup policy on the mgt station
> (Win2K, FW-1 NG FP3 HF2) and setup the cluster object. Everything is fine,
> until I try to get State Sync working.
[...]
> used fw ctl pstat to check outgoing and incoming state sync packets.
> used cphaprob state to check state and interfaces
> used cphastart/cphastop to restart service
> used cpconfig to enable/disable the service
> deleted the policies under $FWDIR/state/
> tried changing the networks used for state sync
>
> I've tried every combination of cpconfig, cphastart/cphastop,
> cpstop/cpstart, rebooting and policy pushes/changes to try to get this
> working. From the previous posts it seems success is completely random. Can
> anybody shed some light on this?
We met the same situation with several 3rd party cluster products.
Technical Support (Check Point/Nokia) adviced us :
1. Check that 'hostname' match 'object name' and 'hosts' files are
consistent on all Check Point boxes (management and firewall
modules).
2. Decrease "sync" load by disabling synchronisation for short time
traffic like HTTP and DNS. You can do that in the "Advanced"
section of "service" objects.
3. Re-initialize synchronisation (cphastop/cphastart). You already
tested this solution.
4. Apply NG FP3 HF2 HFA310 (or HFA312) which fixes the infamous issue
which causes error message like "fwlddist_adjust_buffer: record too
big for sync.". Read the HFA release note because you'll have to
tune a fw kernel parameter (I don't remember the exact name...).
Regards.
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
