vrrp changing reachable addresses

[detsh]

We have 2 NOKIA IP350 boxes IPSO 4.1 and Checkpoint NGX62 as VRRP Cluster. It works pretty fine. When I try to ping the Cluster address from LAN with a PC in the same LAN, one time I get an answer, another time I get 'Request timed out'. Then I ping the physical address, and I get an answer. Another time I can ping the cluster address, but I get 'Request timed out' by pinging the physical.

Could anyone explain, how this work?

(We don't have problems..it's only for my understanding...)

Thx a lot

[cciesec2006]

This is a known issue with Nokia and checkpoint in general if you
ping from a windows machine. To fix this, please do the following:

modzap _fw_allow_simultaneous_ping $FWDIR/boot/modules/fwmod.o 1
reboot

or

fw ctl set int fw_allow_simultaneous_ping 1
however, this option will not survive a reboot or cpstop;cpstart

[detsh]

Thank you for answering,

could this make my cluster unreachable, and have I to do it on both cluster nodes?

What is the default worth for fw_allow_simultaneous_ping ?

[abusharif]

do note that if u enable simul. ping, EVERY ping that you send will be logged by checkpoint as new entry. Which can, in worst case make your logs huuuuge.