Mike Feetham wrote:
I have a question regarding proxy ARPs and HA on SPLAT (R55):
The problem I believe we will run into is that if we add the ARP entries to both enforcement modules in the cluster, then the standby module will ARP for IP addresses that should be controlled by the active module. If traffic bounces back and forth between the modules, due to gratuitous proxy ARPs, I believe we will run into "out of state packet" issues.
You will.
So for those of you with SPLAT HA clusters, can you tell me if this is actually the case? Or is there some magical process that I'm unaware of that will hold off the proxy ARPs until the standby module becomes active?
I wish there was. It would have been a lot easier than what we ended up doing to deal with precisely this problem. We took HA off the firewalls and put Alteon load balancers in front of and behind the firewalls. In effect, we made the firewalls "dumb" devices, while the Alteons handle traffic flow decisions.
More to the point, would the proper procedure be for me to revise my NAT rules and objects to use automatic NAT (and thus automatic proxy ARPs)? If
Unless something has changed in the last couple of years w.r.t. automatic proxy ARPs on Linux, this will not work on SPLAT, which is essentially Redhat Linux at the core of it all.
this is the "proper" solution, then what is the right way to create ARP entries for HIDE NATs?
Outside the scope of your original question, in a non-HA environment, I use the default Hide NAT object (0.0.0.0) and have a single rule in my Address Translation tab for Hide NAT to work. So,
Original Source: my network Original Destination: any that's not my network Translated Source: 0.0.0.0 (HIDE) Translated Destination: Original Install on: all installable targets
================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
