Have you checked that sync packets are being sent and received on both cluster nodes? `fw ctl pstat` on Solaris gives you that detail - not sure about Nokia.
I found two things that can cause sync packets to go missing,
(1) poorly configured switch - make sure you're using a switch that's recommended by Checkpoint, and that you have just basic configuration. Cisco VLANs gave me grief for a while. Of course you could just use a crossover and save yourself headaches...
(2) incorrect netmask on one or more sync interfaces - I had the netmask set as I wanted it in SmartDashboard, but incorrectly on one of my cluster nodes. Packets went out from both nodes, but were never picked up at the other end.
Not sure if that will help you, but hopefully might get you started.
Dave.
Barnaby Tomkins wrote:
In addition, to clarify, I've specified the Sync network under the cluster synchronisation tab and checked 'Use State Synchronisation'.
-----Original Message----- From: Mailing list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED] On Behalf Of Barnaby Tomkins Sent: 13 May 2004 09:39 To: [EMAIL PROTECTED] Subject: [FW-1] Stateful failover problem...
Hi all,
I have recently built 2 x IP330s using IPSO 3.7.1BUILD010 and CheckPoint NG FP3 HF2, and I am having trouble with State Sychronisation during failover.
I've configured the pair using Simplified VRRP, local ARP entries, as Nokia devices don't support CPAutoARP very well and I've used CPAutoNAT.
When failing over, ICMP and web services appear to failover seamlessly, however, more stateful sessions such as Terminal Services, FTP and SecuRemote hang and then disconnect.
Any help would be appreciated!
Thanks, Barny.
Confidentiality Notice This communication is strictly confidential. If you are not the intended recipient, you must not copy, distribute or take any action in reliance of it and destroy this email. The views represented in this email are not necessarily those of Globix.
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
