Patrick, The Firewalls should keep on running when their Management is down and start logging locally.
When talking about the SMTP port, if you are using the SMTP Security Server port 25 is not used (aka you won't see a port LISTENING on port 25) but it will use a port > 1024, usually when the system is rebooted it is somewhere around 1030-1035. Met vriendelijke groeten - Bien � vous - Kind regards Guy ROELANDTS EMEA HPS Internet Expertise Centre - CCSE-NG Hewlett-Packard Belgium B.V.B.A./S.P.R.L. E-mail : [EMAIL PROTECTED] Tel: +32(02)729.85.61 Fax: +32(02)729.77.65 ========================================================== This message may contain confidential and/or proprietary information, and is intended only for the person/entity to whom it was originally addressed. The content of this message may contain private views and opinions which do not constitute a formal disclosure or commitment unless specifically stated. Should you receive this message by mistake please inform the sender immediately. ========================================================== -----Original Message----- From: Mailing list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED] On Behalf Of Audet, Patrick Sent: Monday, March 01, 2004 14:25 To: [EMAIL PROTECTED] Subject: [FW-1] Mng console goes down, so FW's stop processing SMTP traffic ???? We had a strange problems last week. We have a Console managing three firewalls. All are 4.1 SP6 on Sun Solaris. The console apparently went down when it stopped talking on the network. The CP stuff kept running, but I couldn't ping the console and it couldn't ping anything else on it's subnet. About that time, two separate mail relays, on two separate firewalls on two separate subnets stopped working -we couldn't telnet on port 25 to known good mail hosts. In what little logging I could gather, it looks like suddenly the source port of the mail relay changed from normal SMTP (Telnet port 25) to some random high port number range. It seems that when we finally got the console back up on the network, suddenly the mail starts going again. We can't tell if the mail relays really started talking on odd ports or if that is just what the FW's thought they saw as traffic. All systems are running on Solaris boxes. Shouldn't the FW's just keep on running even if the console is down? Do they cache the log data, or is that gone? It doesn't seem that any other access on the FW's was effected - just the smtp traffic. The Console is also segmented from the FW interfaces by a router, so that rules out the network card broadcasting junk and tying up the FW's. Any ideas, or theories what may have happened? Thanks! ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
