Hi Jason, > > Secure Client sends keep alives to the Fw Cluster to keep the > connection > Alive and The Firewall Sends the SCV_keepalive to the Client?? > > Is this correct.
Not quite.... The keep alive for the tunnel is send by the Client. one icmp packet every 20 seconds or so. The SCV_keepalive has to do with the SecureConfigurationVerification. The client has to validate by a set of rules ($fwdir/conf/local.scv) in you can allow traffic on the condition the client is conforming the SCV check. The FW has to know if the Client is SCV'ed hench the SCV-keepalive from the FW to the Client. Both these keepalive are 'one ping only' so they should not have a significant impact on performance. Backconnection is not a security issue, it just makes sure that the tunnel exists as long as the client is running and that it does not time-out so that traffic can be initiated from your network to the client securely through the tunnel. Dion ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
