vrrp and state sync

[Birmingham]

Anyone got any troubleshooting tips for state sync and VRRP.

This should be relatively straightforward but when i do ftp through cluster it drops as master comes up.

Im running NG AI r55 with HFA04 and IPSO 3.5.1 FCS 10 so having the lastest fixes isnt a problem.

Wondering wether i should use cross over cable between state sync interfaces or a hub but i think cross over is the way with vrrp.

Mind you in the back of my mind im really irritated by the fact there isnt a proper Nokia document to follow for doing this. Isnt that the least you would expect.

Really baffled by why im having a problem so if anyone has any tips much appreciated.

 

[scaine]

According to Checkpoint's support compatibility matrix, you'll need IPSO 3.7.1 (Build 10) at least to run R55.

Also, it's worth noting that Nokia released IPSO 3.8.0 on May 24th.

Hope this helps.

 

[Birmingham]

Yep, sorry i got my version numbers messed up.

In the end i solved it by substantially increasing the coldstart delay. Not sure what a typical delay should be but like you i have note 3.8 and it looks like they have made it interface with fw1 better. I think they have removed coldstart delay...so it must be good!.

Thanks again

 

[mdc1973]

Just to let you know- in IPSO 3.8 they have got rid of coldstart delay, however, there is a radio button on the VRRP page along the lines of "monitor firewall state" (enabled by default). This must be disabled, otherwise vrrp won't start- even when the firewall is up.