I setup MEP with Solaris and NG-FP2 where the backend networks are on the same lan.
1) The IP-POOL-NAT for one of the servers covers part of the subnet (ie:
192.168.10.10-100)
2) The IP-POOL-NAT for the other server takes the rest (ie: 192.168.10.101-190).
3) The encryption domain for both servers is fully overlapped.
4) The encryption-domain includes both servers
5) Global policies are set:
enable backup gateways
enable load sharing MEP configuration
enable IP-POOL-NAT...
6) Both servers are checked to be "backup gateways" for the other.
7) Both Gateways are in the "Remote Access" VPN Community.
8) Rules are set for the "Remote Access" in the "Via" column.
xx.xx.xx.1 xx.xx.xx.2
| |
| |
----- -----
| | | |
| | | |
----- -----
| |
| |
192.168.10.1 192.168.10.2
IP-POOL-NAT = 10-100 IP-POOL-NAT = 101-190
For some reason, when I shutdown one of the servers, the SecureRemote Client will
re-authenticate properly to the other server, however, the other server will not setup
a relationship to one of the addresses in it's NAT range. Therefore, no communication
takes place to the encryption-domain.
I've tried both with manually setting proxy ARPs for the IP-POOL-NAT as well as
letting the NG-FP2 set it by using the Auto ARP Configuration (this config didn't work
as well didn't seem to work).
Any Ideas?
--
Thomas Uczekaj - (602) 685-3532
FedEx Freight System - Internet Services Admin
Email - [EMAIL PROTECTED]
**********************************************************
This message contains information that is confidential
and proprietary to FedEx Freight or its affiliates.
It is intended only for the recipient named and for
the express purpose(s) described therein.
Any other use is prohibited.
****************************************************************
=================================================
To set vacation, Out Of Office, or away messages,
send an email to [EMAIL PROTECTED]
in the BODY of the email add:
set fw-1-mailinglist nomail
=================================================
To unsubscribe from this mailing list,
please see the instructions at
http://www.checkpoint.com/services/mailing.html
=================================================
If you have any questions on how to change your
subscription options, email
[EMAIL PROTECTED]
=================================================
