Re: [FW1] Hypothesis: State Sync Nokia/UDP

Wed, 28 Mar 2001 07:39:05 -0800

Timing is critical in state table synchronization.
 
It's also time sensitive, that is, the NTP setting of the firewalls in Voyager
or Lynx needs to point to the same time source.  Use
Stratum 2 time source.
 
State table syncrhonization occurs every 100ms and can last up to 55ms.
In version 4.1, you can create a file that limits what is synchronized so that
selected protocols that connect and disconnect frequently, like DNS (UPD), HTTP,
and IDENT are NOT syncrhonized.  Check out this link
for more information.
 
Make sure you are using a dedicated cross-over cable between the two
firewalls running at 100MBps and setup as a private network (10.x, 172.16, or
192.168).
If all this is true, then when you perform the fw tab -s -t connections, the
numbers between the primary (active) and secondary (standby) firewalls will
be nearly the same, +-100 connections.  The secondary will normally be slightly
behind the primary since the pimary is the one creating and synchronizing
the firewalls.
 
 
David C. Diemer, CCSE
Enterprise Security Firewall Engineer
Georgia Department of Administrative Services (DOAS)
200 Piedmont Ave. SE
Suite 1420, West Tower
Atlanta, GA  30334
[EMAIL PROTECTED]
(V) 404.651.9677
(F) 404.656.0421

>>> <[EMAIL PROTECTED]> 03/28/01 09:25AM >>>


To:   fw-1-mailinglist
Update:

This is the theory. We are surmising ,by the amount of 2 way traffic on the
state sync net, that the Slave (backup) firewall is timeing out the connections
in its state tables and sending/sharing that time out information with the
Master FW. This of course is VERY bad.

This is in ref. to our issues with a couple o pairs of Nokia 440's running VRRP
and state sync. (IPSO 3.3/CP 4.1 sp3)

sync.conf now only has the IP address of its peer.

peers are connected with a crossover cable, show as connected and enabled using
all tools to ascertain. Fail over does work.

We simply cannot keep UDP connections up at all and TCP connections that last
for any length of time are having issues as well.

Any ideas on how to avoid this goofy slave timeing out of connection issue or is
this a "feature" in Nokia's Checkpoint solution. (I sure hope
not)!!!!!!!!!!!!!!!!!!!!!!!!

Bring on the ideas/questions

Howard




================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================

Reply via email to