What is the default setting for the Finger Print Scrambling sub section - ttl? If that is checked, uncheck this also and reinstall.
If it is already unchecked then I guess its another issue. -----Original Message----- From: Daniel Samaan [mailto:[EMAIL PROTECTED] Sent: 18 November 2003 14:35 To: [EMAIL PROTECTED] Subject: Re: [FW-1] NG AI StateSync is not working The default settings in SmartDefense have not changed. Thus fingerprint scrambling is disabled. Daniel Samaan Technical Security Consultant CCSP, CCSE, CCNA, CCA, MCSE+I Cell: (847) 274-2034 [EMAIL PROTECTED] --------------------------------------------------------------------- Forsythe Solutions 5440 W. Fargo Avenue Skokie, IL 60077 www.forsythe.com Delivering the Business Value of IT Mark Pays <[EMAIL PROTECTED] AVEL.COM> To Sent by: Mailing [EMAIL PROTECTED] list for INT.COM discussion of cc Firewall-1 <FW-1-MAILINGLIST Subject @AMADEUS.US.CHECK Re: [FW-1] NG AI StateSync is not POINT.COM> working 11/18/2003 03:02 AM Please respond to Mailing list for discussion of Firewall-1 <FW-1-MAILINGLIST @AMADEUS.US.CHECK POINT.COM> Hi, This sounds just like an issue I had a recently. Are you using Smart Defense? If so switch off Finger Print Scrambling and reinstall your policy. I got this tip from Nokia and it it fixed our problem straight away. After some trial and error I found the following setup worked for Finger Print Scrambling - Finger Print Scrambling - disabled ISN Spoofing - enabled TTL - disabled IP ID - enabled At first though you may want to just uncheck all the options and then reapply them one by one to see which one breaks the vrrp. Your problem sounds identical to the one I had so I hope this fix works for you. Regards, Mark -----Original Message----- From: Daniel Samaan [mailto:[EMAIL PROTECTED] Sent: 18 November 2003 00:38 To: [EMAIL PROTECTED] Subject: [FW-1] NG AI StateSync is not working I have 2 brand new 530's with IPSO 3.7 Build29. I have NG AI R54 installed. Stateful failover is not working. When I unload the policy and turn on IPSO forwarding it works fine, thus I know my VRRP config is correct. Nokia is configured for Legacy VRRP. Cluster object is set for Nokia VRRP (Under 3rd Party Configuration). Synchronization network is set. Topology for sync interface on both cluster member objects has Cluster Interface unchecked for that network. Sync network is connected with a cross-over cable. When I pull the cable to simulate a FO, the LogViewer states reports "State change of Cluster Member1 from active to down was cancelled. since all other cluster members are down. Member remains active". SystemStatus is reporting CLusterXL on FW2 has a Problem. It's Started, but Down. CPHASTAT for FW2 - Product name: High Availability Version: NG with Application Intelligence Status: Problem HA installed: 1 Working mode: Sync only (IPSO cluster) HA started: yes What am I missing here? Cell: (847) 274-2034 [EMAIL PROTECTED] ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ---------------------------------------------------------------------------- -- The opinions expressed within this email represent those of the individual and not necessarily those of Gullivers Travel Associates (GTA). This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify [EMAIL PROTECTED] Should you wish to use email as a form of communication, GTA are unable to guarantee the security of email content outside of our own computer systems. ________________________________________________________________________ This email has been scanned for all viruses by the MessageLabs Email Security System. For more information on a proactive email security service working around the clock, around the globe, visit http://www.messagelabs.com ________________________________________________________________________ ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ________________________________________________________________________ This email has been scanned for all viruses by the MessageLabs Email Security System. For more information on a proactive email security service working around the clock, around the globe, visit http://www.messagelabs.com ________________________________________________________________________ ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
