I have a question regarding proxy ARPs and HA on SPLAT (R55): We are planning on rebuilding a current cluster using SPLAT. The current NAT table includes some manual NATs which, in turn, require static ARP entries. With splat, I know we can manually add ARP entries through SSH.
The problem I believe we will run into is that if we add the ARP entries to both enforcement modules in the cluster, then the standby module will ARP for IP addresses that should be controlled by the active module. If traffic bounces back and forth between the modules, due to gratuitous proxy ARPs, I believe we will run into "out of state packet" issues. So for those of you with SPLAT HA clusters, can you tell me if this is actually the case? Or is there some magical process that I'm unaware of that will hold off the proxy ARPs until the standby module becomes active? More to the point, would the proper procedure be for me to revise my NAT rules and objects to use automatic NAT (and thus automatic proxy ARPs)? If this is the "proper" solution, then what is the right way to create ARP entries for HIDE NATs? TIA, Mike ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
