CPUG

The Check Point User Group

A Resource For The Check Point Community.  Fast.  Useful.  Independent.

1. CCSA/CCSE One-Week Dual-Certification Training Course with CPUG in San Francisco!
    Courses Starting (2009) 1/19, 2/9, 3/9, 4/6, 5/4, 6/8, 7/6, 8/3.
2. Join Us On LinkedIn - We now have a CPUG group.


Go Back   CPUG: The Check Point User Group > Check Point Firewall-1/VPN-1 Platforms > Check Point SecurePlatform (SPLAT)
Register FAQ Members List Calendar Search Today's Posts Mark Forums Read

Reply
 
LinkBack Thread Tools Display Modes
  #1 (permalink)  
Old 2007-06-08
Member
 
Join Date: 2006-05-11
Location: Montreal QC Canada
Posts: 37
Rep Power: 0
Hitman has an average reputation (10+)
Default IP alias problem

Hi,

I have a cluster HA of two members R60 HFA04 on two sunfire X2100

I configure 17 ips alias on eth1 for static natting. After that the /var/log/messages file get flood with these kernel messages:

Kernel: FW-1: fwha_notify_interface: there are more than 4 ips on interface eth1 notifying only ones

In two hours i get more than 15000 entry in the /var/log/messages file on each cluster member.

Except the flooding of /var/log/messages, everything seems to work well, no alarm on the cluster, SmartView monitor report nothing anormal for the two clusters member.

Thanks in advance for your help.
Reply With Quote
  #2 (permalink)  
Old 2007-06-10
Senior Member
 
Join Date: 2005-08-29
Location: Upstate NY
Posts: 1,681
Rep Power: 5
chillyjim has an average reputation (10+)
Send a message via AIM to chillyjim Send a message via Skype™ to chillyjim
Default Re: IP alias problem

Why are you doing this? If you want the module to NAT you should NOT configure those IP addresses and just configure NAT in the object you are NATting.
Reply With Quote
  #3 (permalink)  
Old 2007-06-11
Member
 
Join Date: 2006-05-11
Location: Montreal QC Canada
Posts: 37
Rep Power: 0
Hitman has an average reputation (10+)
Default Re: IP alias problem

Yes, it's working

Thanks Chillyjim.

But it's become rapidly messy in the Address Translation section.

Specially if you have to do static NAT for both the source and the destination because of RPC connection and a private LAN that is not route.

Need 4 rules in automatic instead of 2 in manual

But this solve the filling of my syslog file with the kernel notification message.
Reply With Quote
Reply

Thread Tools
Display Modes

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are Off
[IMG] code is On
HTML code is Off
Trackbacks are On
Pingbacks are On
Refbacks are On


All times are GMT -7. The time now is 07:06.


Powered by vBulletin® Version 3.7.4
Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.
Content Relevant URLs by vBSEO 3.2.0