[cciesec2006]

mcnallym,

thank you very much for your post and I will try what you suggested.

What bothered me is that this identical setup works perfectly with
checkpoint NG AI R55(w). What changes in NGx that makes it stop
working.

The other thing is that I use VRRP configuration even though I only
have a single device but I plan on adding another one in the future.

When running tcpdump on the Nokia, I see it source from the VRRP ip
address. If so, the secondary nodes on the RSA should take care of
this right?

Thanks.