Please HELP

[brierw]

Hello,

We have an IPSO cluster running version 4.2-Build042 HF002 using Checkpoint R60 with HFA04 and are having a very odd issue. We have three ip's, one for each cluster member as would be expected, and one ip for the cluster. Now to the problem...

I cannot ping all three ip's at once. This means if the internal ip's were as follows there would always be one of the three that I was unable to ping.

Cluster member one internal ip 192.168.110.46
Cluster member two internal ip 192.168.110.47
Cluster ip 192.168.110.48

The kicker is the "one" I cannot ping switches randomly between the three ip's without notice??? Does anyone have any ideas or has anyone experienced this before? Tracker does not show there being any issues on the firewall cluster and we are not seeing anyting that isn't working??

We first noticed the problem via our monitoring system, which has a ping to each of the nodes internal ip's as well as the cluster ip, and noticed that it would just randomly start failing??? When we would try from our desks we would also see the same random problem.

Does anyone have anything for me on this? Not really sure where else to look to find this issues root cause.

Thanks in advance for your replies...

[Routerkid1]

I would make sure you allow ping to all members in the rulebase. If it turns out you can not ping the pivot this is normal.

[cciesec2006]

Hi,

This is a known issue since Checkpoint NG Feature Pack 3.
You must ping these IP addresses from a windows right?
If that's true, that is a known issue with Checkpoint on
both SPLAT, Nokia, Windows and Solaris Platform.

Since you have Nokia platform, do the following:

1. Download and install the Modzap Utility from support.nokia.com.

2. On the Security Gateway, type at prompt:

modzap fw_allow_simultaneous_ping $FWDIR/boot/modules/fwmod.o 0x1

3. Reboot the module.

If you do not want to reboot the box, you can do the following:

fw ctl set int fw_allow_simultaneous_ping 1

That will allow you to ping both the physical ip address and the cluster
IP at the same time.