VSX kernel parameter

[anreuter]

Dear Checkpoint Friends,

we are about to bring a pair of Crossbeam X80s (dual box HA used and 2 APMs per box with VSX/NGX R61 on it) into our network, and stumbled over a wired problem recently:

After a failover occurs, all pakets from sessions running across the slave APM
get lost for about 10 -15 seconds. The error situation does not appear after every failover, but if it occurs, it is stays, unless we boot one of the boxes. Checkpoint sync and Crossbeam HA are running on separate cables without any further network (e.g. switches, etc) between the boxes.
We could figure out, that first virtual system does not forward any packet out onto the warp link pointing to the further leading virtual switch for about 15 secs. Our vendor support told us, we need to enable a specific kernel parameter:

„fw_sync_broadcast_ack=1“

But I am not sure, that is is the root cause for our problem here, as is hard to reproduce the error situation.

Is there any experience with this kind of problems on Crossbeam or especially with this kernel parameter ?

Thanks and BR

[djinnah]

We have a dual HA X80 solution running NGAI R55 HFA20. When upgrading to NGX R62 we were told the fw_sync_broadcast_ack=1 was no longer needed. What vendor told you this is required? Maybe the difference is we are not using VSX.

Using this entry in R55 however does not seem to properly tell Checkpoint code to use broadcast because doing a cphaprob -a if the sync net shows its using multicast.

Thougts.
Darian

[lunatrick]

we had the same issue and the command fixed it. i think it probably should have been added to the release notes...