We had a strange problems last week. We have a Console managing three firewalls. All are 4.1 SP6 on Sun Solaris. The console apparently went down when it stopped talking on the network. The CP stuff kept running, but I couldn't ping the console and it couldn't ping anything else on it's subnet. About that time, two separate mail relays, on two separate firewalls on two separate subnets stopped working -we couldn't telnet on port 25 to known good mail hosts. In what little logging I could gather, it looks like suddenly the source port of the mail relay changed from normal SMTP (Telnet port 25) to some random high port number range. It seems that when we finally got the console back up on the network, suddenly the mail starts going again. We can't tell if the mail relays really started talking on odd ports or if that is just what the FW's thought they saw as traffic.
All systems are running on Solaris boxes. Shouldn't the FW's just keep on running even if the console is down? Do they cache the log data, or is that gone? It doesn't seem that any other access on the FW's was effected - just the smtp traffic. The Console is also segmented from the FW interfaces by a router, so that rules out the network card broadcasting junk and tying up the FW's. Any ideas, or theories what may have happened? Thanks! ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
