I thought you have to tell the firewall explicitly to sync VPN traffic. I think there is something on phoneboy.com about this.
-----Original Message----- From: Mellor, Derin [mailto:[EMAIL PROTECTED]] Sent: Friday, December 13, 2002 4:07 AM To: [EMAIL PROTECTED] Subject: Re: [FW-1] IP NOKIA710, CP and Cluster : it works ... On the Master Nokia have you specified a VRRP ColdStart Delay? (see VRRP configuation window). If not I would suggest putting in at least 45s, as this will enable the booting box to get CP operational and the connection tables to be synchronized before it attempts to send and traffic. I'm very interested in the outcome of this as I will be doing similar things next week. Also using CP HA Mng - any experience? Derin -----Original Message----- From: Jean-Francois Gobin [mailto:[EMAIL PROTECTED]] Sent: 13 December 2002 09:52 To: [EMAIL PROTECTED] Subject: [FW-1] IP NOKIA710, CP and Cluster : it works ... Hello, Once, and to show that this list is not fated to "i got a trouble", I can say that my configuration (Cluster of 2 nokia IP710) works! In cause : on both members and cluster, the primary address should be the external one. But ... I wonder if you encountered the same trouble as I did : I'm now playing with the Fail-over : I unplug cable, shot machine off and so on. In same case (both in VRRP configuration or in Nokia Clustering configuration), established VPN seems to refuse to continue to work. The VPN peer is a cisco. In the logs, I can see messages like "Decrypted packet failed SA identity check" and "Decrypt: replay check failed connected id=2000". I can also see in those logs that the last VPN packet received is originated from the physical IP of the interface and not from the Cluster IP. It happens mainly on VRRP recovery (very very easy to reproduce). The "solution" is to send a packet from the remote net to the local one. It seems to trigger the VPN from "pondering about life and everything" to "working again from a cluster's view". Any idea ? JF -- Jean-Francois Gobin - Administrateur gobinjf.be http://www.gobinjf.be mailto:[EMAIL PROTECTED] ================================================= To set vacation, Out Of Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= <FONT SIZE=1>********************************************************************* * This email and any files transmitted with it are confidential and intended solely for the use of the individual or entity to whom they are addressed. If you have received this email in error please notify the sender immediately and then delete from your system. This footnote also confirms that this email message has been swept for the presence of known computer viruses. **********************************************************************</FONT > ================================================= To set vacation, Out Of Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= ================================================= To set vacation, Out Of Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
