 Re: VRRP Issue
I have currently configure both IP380 IPSO 3.71 to run VRRP with Checkpoint R55 loaded.
I have followed the configuration doc (Nokia VRRPmc / CheckPoint NG) but I have encounted some problems.
1 ) When both IP380 is operate in VRRP mode, is that I can see the share VRRP IP address no matter which one is in active state? That is I can see in ifconfig -a (It is because, I can just see it in the active IP380, so each time I can only see the address at one IP380)
2 ) After the fail over to a backup IP380, I found that the internal host cannot access public network, I have issue a tcpdump at the external interface and internal interface and find that the ping packet can reach the public network and get reply from it, but after the Nokia receive back the packets, it cannot pass back to internal host and it drops due to mal-formed icmp packet. Not only for PING traffic, but also for normal internet access, it also fail.
Since both IP380 using the same set of policy, I don't know why onc of the IP380 can do and the other one fail.
Cheers,
Gary  |