Resource temporarily unavailable

[roadrunner]

Resource temporarily unavailable
I have seen this message when attempting to install a policy from a management station to a firewall module and the remote firewall was unreachable. Make sure the site is up. Also make sure the current rule base installed on 'gateway' is not blocking packets from the 'control' machine. See the following URL for information on how to get around that problem: Install an 'accept all' policy on the firewall module .

Mike Barkett makes the following suggestion: Make sure the following three IPs are the same:


fw module IP in $FWDIR/conf/clients
Licensed IP of the FW module
Main IP (General Tab) of the FireWall Module object in the rulebase editor
You'll need to make sure that the fw putkey was executed properly, and that the corresponding masters IP is off of the same interface and licensed as such. If all of this is in place, and you are not installing over a 32k connection, you should be fine.

The connection between the management console and the firewall module could also be timing out. In this case, the "Resource Temporarily Unavailable" message may be a red herring. Look at the output of an 'fw stat' on the remote firewall. You may be surprised to find the security policy did load. Whether it worked or not, follow the steps discussed in the following FAQ: Operation would block .

If you have multiple firewalls in an HA configuration, they are the "default route" to the Internet, and you define the firewalls with the external IP as you should, the primary firewall will succeed, the secondary will fail. To resolve this, explicit static routes are necessary. For example, if you have two firewalls and a management console as so (192.168.0.x are external for this example):


mgmt: 10.0.0.162
firewall-a: 10.0.0.1/192.168.0.1
firewall-b: 10.0.0.2/192.168.0.2
Two explicit routes should be added to your management console (the following is Solaris, modify syntax as appropriate for your platform). This will ensure packets destined for the firewall's external IP go to the specific firewall:


route add 192.168.0.1 10.0.0.1
route add 192.168.0.2 10.0.0.2
If there's an intermediary router between the management console and firewall, these static routes go on the interior router(s) closest to the firewalls instead of the management console.

-- GuyR - 09 Jan 2004


FAQForm
FAQs.Class: RemoteManagementFAQs, TroubleshootingFAQs
FAQs.OS:
FAQs.Version: