I think I know what the problem is. You need to go into Nokia Voyager, uncheck the monitor firewall state, save the configuration on both devices and then reboot both firewalls. That will solve your problems. I remembered running into this issue last year when I first testing NGx R60
Let me know if it works for you. Reinhard Stich <[EMAIL PROTECTED]> wrote: hi, did you try cphastop and cphastart on both modules? are the interfaces defined as sync on the cluster-object? br reinhard At 12:54 28.12.2007, you wrote: >Hi! > >Ping is successful. I have tried cphastop and cphastart several >times without success. The both firewall modules are up and running. > >cpstat ha -f all shows the following: > >Product name: High Availability >Major version: 5 >Minor version: 0 >Service pack: 9 >Version string: N/A >Status code: 0 >Status short: OK >Status long: OK >HA installed: 1 >Working mode: Sync only >HA protocol version: 2 >HA started: yes >HA state: active >HA identifier: 1 > > >Interface table >---------------------------------------------------------- >|Name |IP |Status|Verified|Trusted|Shared| >---------------------------------------------------------- >|eth-s3p1c0| 10.40.253.165|Up | 0| 0| 0| >|eth-s1p1c0| 192.168.12.12 Up | 0| 0| 0| >|eth4c0 | 10.40.251.18|Up | 1400| 0| 0| >|eth2c0 | 10.40.254.165|Up | 0| 1| 0| >|eth3c0 | 10.191.66.66|Up | 6600| 0| 0| >|eth1c0 | 10.40.10.112|Up | 0| 0| 0| >---------------------------------------------------------- > > > >Problem Notification table >------------------------------------------------ >|Name |Status|Priority|Verified|Descr| >------------------------------------------------ >|Synchronization|OK | 0| 332463| | >|Filter |OK | 0| 9885| | >|fwd |OK | 0| 0| | >|cphad |OK | 0| 0| | >------------------------------------------------ > >-lari- > > > >-----Original Message----- >From: Mailing list for discussion of Firewall-1 on behalf of Reinhard Stich >Sent: Fri 12/28/2007 12:33 PM >To: [email protected] >Subject: Re: [FW-1] Sync problem in VRRP cluster > >hi, > >do you have the connection between the 2 nokias on the >sync-interface? can you ping the other box? >if the connection 100Mbit/full-duplex? > >are the 2 firewall-modules up and running "cpstat fw"? > >try to run "cphastart" and check if clusterXL is enabled in "cpconfig". > >br >reinhard > >At 11:02 28.12.2007, you wrote: > >Hello Gurus, > > > >I have a VRRP cluster with two IP740s with IPSO 4.1_build013. I'm > >here in the middle of a strange troubleshooting session. Here are > the details: > > > >The sync is not working fine. cphaprob state gives the following output. > > > >fw1[admin]# cphaprob state > > > >Cluster Mode: Sync only (IPSO cluster)) > > > >Number Unique Address Firewall State (*) > > > >1 10.40.254.165 active > >2 (local) 10.40.254.166 down > > > >I tried to unregister and re-register devices from cphaprob list, > >but it didn't help. I also have rebooted the problematic cluster member. > > > >fw ctl pstat gives the following message. > > > >Sync: > > Version: new > > Status: > > Unable to send sync packets > > Unable to receive sync packets > > > >fwd.elg file is filled up with the following message: > > > >fwsyncn_connected: connection to 10.40.254.165 failed. error=-5 > > > >Any ideas anyone? > > > >Wishing You very happy New Year! > > > >-lari- > > > > > >Lari Luoma > >Senior Network Security Specialist > >Mainframe Consulting Oy > >[EMAIL PROTECTED] > >+358-45-6576820 > >www.mainframe.fi > > > > > >================================================= > >To set vacation, Out-Of-Office, or away messages, > >send an email to [EMAIL PROTECTED] > >in the BODY of the email add: > >set fw-1-mailinglist nomail > >================================================= > >To unsubscribe from this mailing list, > >please see the instructions at > >http://www.checkpoint.com/services/mailing.html > >================================================= > >If you have any questions on how to change your > >subscription options, email > >[EMAIL PROTECTED] > >================================================= > >-- >Reinhard Stich [EMAIL PROTECTED] >Internet Security AG, 1150 Wien, Johnstrasse 29 >Tel: +43 1 3709440 RS784-RIPE Fax: +43 1 3709440-333 > > >Scanned by Check Point Total Security Gateway. > >================================================= >To set vacation, Out-Of-Office, or away messages, >send an email to [EMAIL PROTECTED] >in the BODY of the email add: >set fw-1-mailinglist nomail >================================================= >To unsubscribe from this mailing list, >please see the instructions at >http://www.checkpoint.com/services/mailing.html >================================================= >If you have any questions on how to change your >subscription options, email >[EMAIL PROTECTED] >================================================= > > > > >Scanned by Check Point Total Security Gateway. > > >================================================= >To set vacation, Out-Of-Office, or away messages, >send an email to [EMAIL PROTECTED] >in the BODY of the email add: >set fw-1-mailinglist nomail >================================================= >To unsubscribe from this mailing list, >please see the instructions at >http://www.checkpoint.com/services/mailing.html >================================================= >If you have any questions on how to change your >subscription options, email >[EMAIL PROTECTED] >================================================= -- Reinhard Stich [EMAIL PROTECTED] Internet Security AG, 1150 Wien, Johnstrasse 29 Tel: +43 1 3709440 RS784-RIPE Fax: +43 1 3709440-333 Scanned by Check Point Total Security Gateway. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= --------------------------------- Never miss a thing. Make Yahoo your homepage. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
