Hi,
On Fri, 2003-06-06 at 01:00, Paleologus, Tony wrote:
> I've setup two Nokia IP440's w/IPSO 3.6 FCS6 and FW-1/VPN-1 NG FP3 HF2. I've
> configured one FE card to be the in/out using two VLANs. They use VRRP (on
> different vrouter #'s) and work fine. I setup policy on the mgt station
> (Win2K, FW-1 NG FP3 HF2) and setup the cluster object. Everything is fine,
> until I try to get State Sync working.
[...]
> used fw ctl pstat to check outgoing and incoming state sync packets.
> used cphaprob state to check state and interfaces
> used cphastart/cphastop to restart service
> used cpconfig to enable/disable the service
> deleted the policies under $FWDIR/state/
> tried changing the networks used for state sync
>
> I've tried every combination of cpconfig, cphastart/cphastop,
> cpstop/cpstart, rebooting and policy pushes/changes to try to get this
> working. From the previous posts it seems success is completely random. Can
> anybody shed some light on this?
We met the same situation with several 3rd party cluster products.
Technical Support (Check Point/Nokia) adviced us :
1. Check that 'hostname' match 'object name' and 'hosts' files are
consistent on all Check Point boxes (management and firewall
modules).
2. Decrease "sync" load by disabling synchronisation for short time
traffic like HTTP and DNS. You can do that in the "Advanced"
section of "service" objects.
3. Re-initialize synchronisation (cphastop/cphastart). You already
tested this solution.
4. Apply NG FP3 HF2 HFA310 (or HFA312) which fixes the infamous issue
which cause error message like "fwlddist_adjust_buffer: record too
big for sync."
>
> I have not tried, but will tomorrow, rebuilding under IPSO 3.5 FCS14, also a
> consideration might be to go to Nokia IPClustering, but this "should" work,
> right? I'm currently using it under 4.1SP6/IPSO 3.5FCS14 in production.
>
> Any help/ideas/suggestions would be greatly appreciated.
>
> thanks!
> -Tony
>
>
>
>
> Tony Paleologus - Network Engineer
> Synygy, Inc.
> 555 North Lane, Suite 6000
> Conshohocken, PA 19428
> Phone: 610.664.7433 ext 7590
> Fax: 610.664.7343
> mailto:[EMAIL PROTECTED]
>
>
>
> =================================================
> To set vacation, Out-Of-Office, or away messages,
> send an email to [EMAIL PROTECTED]
> in the BODY of the email add:
> set fw-1-mailinglist nomail
> =================================================
> To unsubscribe from this mailing list,
> please see the instructions at
> http://www.checkpoint.com/services/mailing.html
> =================================================
> If you have any questions on how to change your
> subscription options, email
> [EMAIL PROTECTED]
> =================================================
--
[EMAIL PROTECTED] Cyber Networks France
http://www.freebsd.org http://www.cyber-networks.fr
PGP Key fingerprint = 9AEA 910F CB46 C39B 89EE EF4C 68AC 2AF1 CF17 3713
http://pgp.mit.edu:11371/pks/lookup?op=get&search=0xCF173713
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
