If you're using certificate for authentication from the internal certificate authority, the CRL (certificate revocation list) is cached on the enforcement module, but I believe it has a life of 7 days. If the CRL expires while the management station is down, you probably have a problem.
The only issue we have seen is that certificate users cannot change their certificate password while the management station is down. I take mine down to create a disaster recovery image once a month. It takes about two hours and every now and then someone will try to change their certificate password and get an "internal error" message. It works after the management station is back online.
If you're using certificates, you need to have a backup of the certificate database to restore functionality.
You also need a copy of the rule base because I don't think there is any way to retrieve it from the enforcement module. If there is, I'd sure like to know how to do it.
Ray
From: Bernardo Santos Wernesback <[EMAIL PROTECTED]> Reply-To: Mailing list for discussion of Firewall-1 <[EMAIL PROTECTED]> To: [EMAIL PROTECTED] Subject: [FW-1] What happens to a Checkpoint Cluster if Management Server Crashes? Date: Thu, 15 Apr 2004 14:46:35 -0300
Hello everyone,
I've been studying a bit about checkpoint and so far haven't seen documentation about the consequences of a Management Server crashing. Imagine that I have a cluster with 2 enforcement modules and onlye 1 management module.
What happens if:
1) ... Management Server is unavailable? Do the enforcement modules still work? Is there a time limit? What happens to the logs, are they cached?
2) ... Management Server crashes completely and I have to reinstall the whole machine? Is it simply a matter of rebuilding the SIC trust between the enforcement modules and the management module and then downloading the policy from the enforcement modules?
Thanks in advance for any thoughts on this subject.
Best Regards, Bernardo.
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
_________________________________________________________________ Limited-time offer: Fast, reliable MSN 9 Dial-up Internet access FREE for 2 months! http://join.msn.com/?page=dept/dialup&pgmarket=en-us&ST=1/go/onm00200361ave/direct/01/
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
