Lari, This is a full synchronization issue that HFA_06 for IPSO should resolve.
Din -----Original Message----- From: Mailing list for discussion of Firewall-1 [mailto:[EMAIL PROTECTED] On Behalf Of Lari Luoma Sent: Friday, December 28, 2007 8:36 AM To: [email protected] Subject: Re: [FW-1] Sync problem in VRRP cluster Thanks for all the information. Unfortunately I already tried all these before posting my message on the list...;-) I have also rebooted the problematic device. Sync-interfaces on both cluster members are running multicast, but I have tried broadcast as well. eth2c0 sync(secured), multicast -lari- -----Original Message----- From: Mailing list for discussion of Firewall-1 on behalf of Reinhard Stich Sent: Fri 12/28/2007 2:48 PM To: [email protected] Subject: Re: [FW-1] Sync problem in VRRP cluster hi, did you try cphastop and cphastart on both modules? are the interfaces defined as sync on the cluster-object? br reinhard At 12:54 28.12.2007, you wrote: >Hi! > >Ping is successful. I have tried cphastop and cphastart several >times without success. The both firewall modules are up and running. > >cpstat ha -f all shows the following: > >Product name: High Availability >Major version: 5 >Minor version: 0 >Service pack: 9 >Version string: N/A >Status code: 0 >Status short: OK >Status long: OK >HA installed: 1 >Working mode: Sync only >HA protocol version: 2 >HA started: yes >HA state: active >HA identifier: 1 > > >Interface table >---------------------------------------------------------- >|Name |IP |Status|Verified|Trusted|Shared| >---------------------------------------------------------- >|eth-s3p1c0| 10.40.253.165|Up | 0| 0| 0| >|eth-s1p1c0| 192.168.12.12 Up | 0| 0| 0| >|eth4c0 | 10.40.251.18|Up | 1400| 0| 0| >|eth2c0 | 10.40.254.165|Up | 0| 1| 0| >|eth3c0 | 10.191.66.66|Up | 6600| 0| 0| >|eth1c0 | 10.40.10.112|Up | 0| 0| 0| >---------------------------------------------------------- > > > >Problem Notification table >------------------------------------------------ >|Name |Status|Priority|Verified|Descr| >------------------------------------------------ >|Synchronization|OK | 0| 332463| | >|Filter |OK | 0| 9885| | >|fwd |OK | 0| 0| | >|cphad |OK | 0| 0| | >------------------------------------------------ > >-lari- > > > >-----Original Message----- >From: Mailing list for discussion of Firewall-1 on behalf of Reinhard Stich >Sent: Fri 12/28/2007 12:33 PM >To: [email protected] >Subject: Re: [FW-1] Sync problem in VRRP cluster > >hi, > >do you have the connection between the 2 nokias on the >sync-interface? can you ping the other box? >if the connection 100Mbit/full-duplex? > >are the 2 firewall-modules up and running "cpstat fw"? > >try to run "cphastart" and check if clusterXL is enabled in "cpconfig". > >br >reinhard > >At 11:02 28.12.2007, you wrote: > >Hello Gurus, > > > >I have a VRRP cluster with two IP740s with IPSO 4.1_build013. I'm > >here in the middle of a strange troubleshooting session. Here are > the details: > > > >The sync is not working fine. cphaprob state gives the following output. > > > >fw1[admin]# cphaprob state > > > >Cluster Mode: Sync only (IPSO cluster)) > > > >Number Unique Address Firewall State (*) > > > >1 10.40.254.165 active > >2 (local) 10.40.254.166 down > > > >I tried to unregister and re-register devices from cphaprob list, > >but it didn't help. I also have rebooted the problematic cluster member. > > > >fw ctl pstat gives the following message. > > > >Sync: > > Version: new > > Status: > > Unable to send sync packets > > Unable to receive sync packets > > > >fwd.elg file is filled up with the following message: > > > >fwsyncn_connected: connection to 10.40.254.165 failed. error=-5 > > > >Any ideas anyone? > > > >Wishing You very happy New Year! > > > >-lari- > > > > > >Lari Luoma > >Senior Network Security Specialist > >Mainframe Consulting Oy > >[EMAIL PROTECTED] > >+358-45-6576820 > >www.mainframe.fi > > > > > >================================================= > >To set vacation, Out-Of-Office, or away messages, > >send an email to [EMAIL PROTECTED] > >in the BODY of the email add: > >set fw-1-mailinglist nomail > >================================================= > >To unsubscribe from this mailing list, > >please see the instructions at > >http://www.checkpoint.com/services/mailing.html > >================================================= > >If you have any questions on how to change your > >subscription options, email > >[EMAIL PROTECTED] > >================================================= > >-- >Reinhard Stich [EMAIL PROTECTED] >Internet Security AG, 1150 Wien, Johnstrasse 29 >Tel: +43 1 3709440 RS784-RIPE Fax: +43 1 3709440-333 > > >Scanned by Check Point Total Security Gateway. > >================================================= >To set vacation, Out-Of-Office, or away messages, >send an email to [EMAIL PROTECTED] >in the BODY of the email add: >set fw-1-mailinglist nomail >================================================= >To unsubscribe from this mailing list, >please see the instructions at >http://www.checkpoint.com/services/mailing.html >================================================= >If you have any questions on how to change your >subscription options, email >[EMAIL PROTECTED] >================================================= > > > > >Scanned by Check Point Total Security Gateway. > > >================================================= >To set vacation, Out-Of-Office, or away messages, >send an email to [EMAIL PROTECTED] >in the BODY of the email add: >set fw-1-mailinglist nomail >================================================= >To unsubscribe from this mailing list, >please see the instructions at >http://www.checkpoint.com/services/mailing.html >================================================= >If you have any questions on how to change your >subscription options, email >[EMAIL PROTECTED] >================================================= -- Reinhard Stich [EMAIL PROTECTED] Internet Security AG, 1150 Wien, Johnstrasse 29 Tel: +43 1 3709440 RS784-RIPE Fax: +43 1 3709440-333 Scanned by Check Point Total Security Gateway. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= Scanned by Check Point Total Security Gateway. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] ================================================= Scanned by Check Point Total Security Gateway. ================================================= To set vacation, Out-Of-Office, or away messages, send an email to [EMAIL PROTECTED] in the BODY of the email add: set fw-1-mailinglist nomail ================================================= To unsubscribe from this mailing list, please see the instructions at http://www.checkpoint.com/services/mailing.html ================================================= If you have any questions on how to change your subscription options, email [EMAIL PROTECTED] =================================================
