We NEVER recommend these to customers. Its usually easier for us to upgrade them to hard disk based units or replace them with SPLAT, instead of watching the customer hobble along with a broken foot. The only hope you have for one of these units is to purchase, or insist that you be given hard disks to add to the flash based units. Why you would want a unit with no storage capacity is beyond me. Maybe if you are putting the unit on the Space Shuttle, and there is some kind of friction/moving parts issue, but then again that's rocket science, and not my specialty.
Frank -----Original Message----- From: Mailing list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED] On Behalf Of Hugo van der Kooij Sent: Monday, October 22, 2007 4:22 PM To: [email protected] Subject: Re: [FW-1] [SPAM] [FW-1] ofiller.exe and address ranges -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Thorsten Mandau wrote: > Hi all, > > thank you for your input. I guess I won't take the risk of getting into > performance issues since this firewall is very critical. Hmm. I was required to do some troubleshooting into an issue where a policy installation resulted in a failover situation (VRRP cluster). I notice a few range objects being used. It seemed that the use of a range object of 0.0.0.0-255.255.255.255 or a network object of 0.0.0.0/0.0.0.0 had the exact same inpact on the compiled policy. Neither of them exploded on this NGX R61 installation. The policy installed was not that extreem if you take into account it was over 350 rules for a single cluster only. So it seems optimalisation is used on those objects. Propably along the same type one can observe sometimes in the VPN-1 Edge VPN topology (/vpntop.html in the webinterface) I would not insert 6000 object at once but do this in stages so you can see the impact and see at what point you notice impact on the firewall. What was weird by the way was that hourly tcl script on Nokia going wild and consuming enourmous amounts of CPU time. I am more and more convinced that flash based Nokia's are in fact very very evil. I rather risk a broken disk then having to run IPSO, NGX and swap on 1 GB flash drive. I think I will sleep much better if we replace all flash based Nokia's with disk based ones. Hugo. - -- [EMAIL PROTECTED] http://hugo.vanderkooij.org/ PGP/GPG? Use: http://hugo.vanderkooij.org/0x58F19981.asc A: Yes. >Q: Are you sure? >>A: Because it reverses the logical flow of conversation. >>>Q: Why is top posting frowned upon? Bored? Click on http://spamornot.org/ and rate those images. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.7 (GNU/Linux) iD8DBQFHHQZmBvzDRVjxmYERAugGAJ47UY/nMpwA9fbibtpSomRE8RHHwwCfWtHR R2Nal7JNOWhI3S4k88gB7AE= =rW9x -----END PGP SIGNATURE----- ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
