Hi, Now that you have access I'd look at the SmartView Tracker. It's possible you have anti-spoofing logs there.
Yonadav Leitersdorf CEO & Founder, indeni Ltd. --------------------------------------------------------------------- US: 1-646-291-8954 Int'l: +972-54-801-802-8 UK: 0203-514-1396 Email: [email protected] On Thu, Dec 22, 2011 at 10:50 AM, a bv <[email protected]> wrote: > Hi > > Another try. after a day > > i ran arp- a from my PC couldnt see an entry releated to firewalls IP, > wasnt able to ping. > > > i went to the firewall console > > ran arp -a couldnt see any entry releated to my PCs IP > > I ran ping myPCsIP 1-2 times and then arp -a my PCs entry came there > but still coudnt ping. > > I ran fw unloadlocal then gave the ping MYPCSIP command and it again > worked and now im able to > logon to dashboard and ssh but my ping -t from my PC to fwsIP and > sometimes reply is broken. If ill install a policy i guess that > connection will again broken. > > Im still trying to find out and wourkout the problem, why fw > unloadlocal makes it work again etc? > > Regards > > > > > > 2011/12/21 a bv <[email protected]>: > > Now i cant ping the firewall form my pc, i worked on it today. now > > when i do a netstat -a at my > > command prompt i cant see any releated entry to the firewalls IP? > > > > > > > > 2011/12/21 Hugo van der Kooij <[email protected]>: > >> > >> > >> On 20.12.2011 10:25, a bv wrote: > >> > >>> Here is the output of netstat > >> -ni;sleep 60;netstat -ni;sleep > >>> 60;netstat -ni;sleep 60;netstat -ni. > >> While this command was running i > >>> opened the dashboard logined and > >> tried to install policy but i get > >>> disconnected from dashboard, also my > >> ssh conenction lost, command > >>> prompt get started request time out > >> response . > >> > >> As netstat is not showing dropped or errored packets I would > >> closely look into ARP tables as it sounds like you have a duplicate IP > >> adres. Physically check all the omponents if needed to make sure no one > >> put in another host with the IP address of the firewall. (Yep, I have > >> seen it happen and the customer was mightily surprised to find that > >> someone just brutely installed an unlisted server in their network. But > >> the ARP information gave it away from miles and miles away.) > >> > >> Hugo. > >> > >> -- > >> > >> [email protected] http://hugo.vanderkooij.org/ > >> PGP/GPG? Use: > >> http://hugo.vanderkooij.org/0x58F19981.asc > >> > >> ================================================= > >> To set vacation, Out-Of-Office, or away messages, > >> send an email to [email protected] > >> in the BODY of the email add: > >> set fw-1-mailinglist nomail > >> ================================================= > >> To unsubscribe from this mailing list, > >> please see the instructions at > >> http://www.checkpoint.com/services/mailing.html > >> ================================================= > >> If you have any questions on how to change your > >> subscription options, email > >> [email protected] > >> ================================================= > >> > > Scanned by Check Point Total Security Gateway. > > ================================================= > To set vacation, Out-Of-Office, or away messages, > send an email to [email protected] > in the BODY of the email add: > set fw-1-mailinglist nomail > ================================================= > To unsubscribe from this mailing list, > please see the instructions at > http://www.checkpoint.com/services/mailing.html > ================================================= > If you have any questions on how to change your > subscription options, email > [email protected] > ================================================= > ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [email protected] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [email protected] =================================================
