Hi,
This sounds just like an issue I had a recently. Are you using Smart
Defense? If so switch off Finger Print Scrambling and reinstall your policy.
I got this tip from Nokia and it it fixed our problem straight away.
After some trial and error I found the following setup worked for Finger
Print Scrambling -
Finger Print Scrambling - disabled
ISN Spoofing - enabled
TTL - disabled
IP ID - enabled
At first though you may want to just uncheck all the options and then
reapply them one by one to see which one breaks the vrrp. Your problem
sounds identical to the one I had so I hope this fix works for you.
Regards,
Mark
-----Original Message-----
From: Daniel Samaan [mailto:[EMAIL PROTECTED]
Sent: 18 November 2003 00:38
To: [EMAIL PROTECTED]
Subject: [FW-1] NG AI StateSync is not working
I have 2 brand new 530's with IPSO 3.7 Build29. I have NG AI R54
installed.
Stateful failover is not working. When I unload the policy and turn on
IPSO forwarding it works fine, thus I know my VRRP config is correct.
Nokia is configured for Legacy VRRP. Cluster object is set for Nokia VRRP
(Under 3rd Party Configuration). Synchronization network is set. Topology
for sync interface on both cluster member objects has Cluster Interface
unchecked for that network. Sync network is connected with a cross-over
cable.
When I pull the cable to simulate a FO, the LogViewer states reports "State
change of Cluster Member1 from active to down was cancelled. since all
other cluster members are down. Member remains active".
SystemStatus is reporting CLusterXL on FW2 has a Problem. It's Started, but
Down.
CPHASTAT for FW2 -
Product name: High Availability
Version: NG with Application Intelligence
Status: Problem
HA installed: 1
Working mode: Sync only (IPSO cluster)
HA started: yes
What am I missing here?
Cell: (847) 274-2034
[EMAIL PROTECTED]
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
------------------------------------------------------------------------------
The opinions expressed within this email represent those of the
individual and not necessarily those of Gullivers Travel Associates (GTA).
This email and any files transmitted with it are confidential and intended
solely for the use of the individual or entity to whom they are addressed.
If you have received this email in error please notify [EMAIL PROTECTED]
Should you wish to use email as a form of communication, GTA are unable to
guarantee the security of email content outside of our own computer systems.
________________________________________________________________________
This email has been scanned for all viruses by the MessageLabs Email
Security System. For more information on a proactive email security
service working around the clock, around the globe, visit
http://www.messagelabs.com
________________________________________________________________________
=================================================
To set vacation, Out-Of-Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
