Problems from CP to CSS Load Balancer

[karimi]

We have a NAT IP on our Checkpoint Nokia Cluster which is a permanent proxy arp. The NAT IP on the public side translates to an internal IP (10.2.70.161) which is the CSS Load Balancer IP. It receives a request on port 443 and translates to port 8001 on the 2 servers behind the LB.

Sometimes it works, sometimes it doesn't. We can ping the internal server from the server, so there is no routing problem. But when we try to telnet on port 443 or port 8001, it doesn't respond. We ran the packet trace from the firewall, and the one weird thing we see is that that in the 2nd line, the CSS doesn't respond with the original destination port (8001) it responds with a high port (19123).

We are wondering why the load balancer does this, and if it is the reason we are getting intermittant response between the Nokia and Load Balancer VIP?



MDC-CORE-FW1[admin]# tcpdump -i eth3c0 | grep 10.2.70.161
tcpdump: listening on eth3c0
08:28:11.049003 O 10.2.70.130.4319 > 10.2.70.161.8001: S 1621157889:1621157889(0) win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp[|tcp]> [tos 0x10] 08:28:11.052860 I 10.2.70.161.19123 > 10.2.70.130.4319: S 1019055775:1019055775(0) ack 1621157890 win 49232 <nop,nop,timestamp 75441971 6398017,mss[|tcp]> (DF)
08:28:13.839044 O 10.2.70.130.4319 > 10.2.70.161.8001: S 1621157889:1621157889(0) win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp[|tcp]> [tos 0x10]
08:28:13.839742 I 10.2.70.161.19123 > 10.2.70.130.4319: . ack 1 win 49232 <nop,nop,timestamp 75442250 6398017> (DF)
08:28:14.424161 I 10.2.70.161.19123 > 10.2.70.130.4319: S 1019055775:1019055775(0) ack 1621157890 win 49232 <nop,nop,timestamp 75442309 6398017,mss[|tcp]> (DF)
08:28:19.839177 O 10.2.70.130.4319 > 10.2.70.161.8001: S 1621157889:1621157889(0) win 16384 <mss 1460,nop,wscale 0,nop,nop,timestamp[|tcp]> [tos 0x10]
08:28:19.840746 I 10.2.70.161.19123 > 10.2.70.130.4319: . ack 1 win 49232 <nop,nop,timestamp 75442850 6398017> (DF)
08:28:21.182457 I 10.2.70.161.19123 > 10.2.70.130.4319: S 1019055775:1019055775(0) ack 1621157890 win 49232 <nop,nop,timestamp 75442985 6398017,mss[|tcp]> (DF)