I got it working, but the root cause is missing...;-) Seems like a software bug or something...
This is what I did... I disabled cluster-membership from the problematic side using cpconfig and rebooted. Then I enabled it and rebooted again. fw2[admin]# cphaprob state Cluster Mode: Sync only (IPSO cluster)) Number Unique Address Firewall State (*) 1 10.40.254.165 active 2 (local) 10.40.254.166 active Thanks for your support, everyone! -lari- -----Original Message----- From: Mailing list for discussion of Firewall-1 on behalf of Din Cox Sent: Fri 12/28/2007 6:49 PM To: [email protected] Subject: Re: [FW-1] Sync problem in VRRP cluster Lari, I agree with you but sometime that's not necessarily the case. For example there was a bug in R62 SmartConsole that caused SmartDashboard to hang when saving changes after smartdefense update. This was resolved by simply installing the patched version of R62. However, only a few R62 customers were affected. Strange right? Verify the HFA on the other systems if you haven't already. Here is the link to the HFA_06 release notes. http://www.checkpoint.com/downloads/latest/hfa/vpn1_power/r60_ipso.html Din -----Original Message----- From: Mailing list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED] On Behalf Of Lari Luoma Sent: Friday, December 28, 2007 10:58 AM To: [email protected] Subject: Re: [FW-1] Sync problem in VRRP cluster Hello Din, Thank You for your comment, but there is one thing that makes me doubt patching would be the solution... My customer has several similar configurations (HW and SW) that are working fine. If it were a hotfix issue, they all had failed, hadn't they? -lari- -----Original Message----- From: Mailing list for discussion of Firewall-1 on behalf of Din Cox Sent: Fri 12/28/2007 4:07 PM To: [email protected] Subject: Re: [FW-1] Sync problem in VRRP cluster Lari, This is a full synchronization issue that HFA_06 for IPSO should resolve. Din -----Original Message----- From: Mailing list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED] On Behalf Of Lari Luoma Sent: Friday, December 28, 2007 8:36 AM To: [email protected] Subject: Re: [FW-1] Sync problem in VRRP cluster Thanks for all the information. Unfortunately I already tried all these before posting my message on the list...;-) I have also rebooted the problematic device. Sync-interfaces on both cluster members are running multicast, but I have tried broadcast as well. eth2c0 sync(secured), multicast -lari- -----Original Message----- From: Mailing list for discussion of Firewall-1 on behalf of Reinhard Stich Sent: Fri 12/28/2007 2:48 PM To: [email protected] Subject: Re: [FW-1] Sync problem in VRRP cluster hi, did you try cphastop and cphastart on both modules? are the interfaces defined as sync on the cluster-object? br reinhard At 12:54 28.12.2007, you wrote: >Hi! > >Ping is successful. I have tried cphastop and cphastart several >times without success. The both firewall modules are up and running. > >cpstat ha -f all shows the following: > >Product name: High Availability >Major version: 5 >Minor version: 0 >Service pack: 9 >Version string: N/A >Status code: 0 >Status short: OK >Status long: OK >HA installed: 1 >Working mode: Sync only >HA protocol version: 2 >HA started: yes >HA state: active >HA identifier: 1 > > >Interface table >---------------------------------------------------------- >|Name |IP |Status|Verified|Trusted|Shared| >---------------------------------------------------------- >|eth-s3p1c0| 10.40.253.165|Up | 0| 0| 0| >|eth-s1p1c0| 192.168.12.12 Up | 0| 0| 0| >|eth4c0 | 10.40.251.18|Up | 1400| 0| 0| >|eth2c0 | 10.40.254.165|Up | 0| 1| 0| >|eth3c0 | 10.191.66.66|Up | 6600| 0| 0| >|eth1c0 | 10.40.10.112|Up | 0| 0| 0| >---------------------------------------------------------- > > > >Problem Notification table >------------------------------------------------ >|Name |Status|Priority|Verified|Descr| >------------------------------------------------ >|Synchronization|OK | 0| 332463| | >|Filter |OK | 0| 9885| | >|fwd |OK | 0| 0| | >|cphad |OK | 0| 0| | >------------------------------------------------ > >-lari- > > > >-----Original Message----- >From: Mailing list for discussion of Firewall-1 on behalf of Reinhard Stich >Sent: Fri 12/28/2007 12:33 PM >To: [email protected] >Subject: Re: [FW-1] Sync problem in VRRP cluster > >hi, > >do you have the connection between the 2 nokias on the >sync-interface? can you ping the other box? >if the connection 100Mbit/full-duplex? > >are the 2 firewall-modules up and running "cpstat fw"? > >try to run "cphastart" and check if clusterXL is enabled in "cpconfig". > >br >reinhard > >At 11:02 28.12.2007, you wrote: > >Hello Gurus, > > > >I have a VRRP cluster with two IP740s with IPSO 4.1_build013. I'm > >here in the middle of a strange troubleshooting session. Here are > the details: > > > >The sync is not working fine. cphaprob state gives the following output. > > > >fw1[admin]# cphaprob state > > > >Cluster Mode: Sync only (IPSO cluster)) > > > >Number Unique Address Firewall State (*) > > > >1 10.40.254.165 active > >2 (local) 10.40.254.166 down > > > >I tried to unregister and re-register devices from cphaprob list, > >but it didn't help. I also have rebooted the problematic cluster member. > > > >fw ctl pstat gives the following message. > > > >Sync: > > Version: new > > Status: > > Unable to send sync packets > > Unable to receive sync packets > > > >fwd.elg file is filled up with the following message: > > > >fwsyncn_connected: connection to 10.40.254.165 failed. error=-5 > > > >Any ideas anyone? > > > >Wishing You very happy New Year! > > > >-lari- > > > > > >Lari Luoma > >Senior Network Security Specialist > >Mainframe Consulting Oy > >[EMAIL PROTECTED] > >+358-45-6576820 > >www.mainframe.fi > > > > > >================================================= > >To set vacation, Out-Of-Office, or away messages, > >send an email to [EMAIL PROTECTED] > >in the BODY of the email add: > >set fw-1-mailinglist nomail > >================================================= > >To unsubscribe from this mailing list, > >please see the instructions at > >http://www.checkpoint.com/services/mailing.html > >================================================= > >If you have any questions on how to change your > >subscription options, email > >[EMAIL PROTECTED] > >================================================= > >-- >Reinhard Stich [EMAIL PROTECTED] >Internet Security AG, 1150 Wien, Johnstrasse 29 >Tel: +43 1 3709440 RS784-RIPE Fax: +43 1 3709440-333 > > >Scanned by Check Point Total Security Gateway. > >================================================= >To set vacation, Out-Of-Office, or away messages, >send an email to [EMAIL PROTECTED] >in the BODY of the email add: >set fw-1-mailinglist nomail >================================================= >To unsubscribe from this mailing list, >please see the instructions at >http://www.checkpoint.com/services/mailing.html >================================================= >If you have any questions on how to change your >subscription options, email >[EMAIL PROTECTED] >================================================= > > > > >Scanned by Check Point Total Security Gateway. > > >================================================= >To set vacation, Out-Of-Office, or away messages, >send an email to [EMAIL PROTECTED] >in the BODY of the email add: >set fw-1-mailinglist nomail >================================================= >To unsubscribe from this mailing list, >please see the instructions at >http://www.checkpoint.com/services/mailing.html >================================================= >If you have any questions on how to change your >subscription options, email >[EMAIL PROTECTED] >================================================= -- Reinhard Stich [EMAIL PROTECTED] Internet Security AG, 1150 Wien, Johnstrasse 29 Tel: +43 1 3709440 RS784-RIPE Fax: +43 1 3709440-333 Scanned by Check Point Total Security Gateway. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= Scanned by Check Point Total Security Gateway. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= Scanned by Check Point Total Security Gateway. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= Scanned by Check Point Total Security Gateway. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= Scanned by Check Point Total Security Gateway. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
