fw_getfwifnum: no interface name

[gbib1dde]

Hi there

We have recently deployed a fault tollerant cluster running on IPSO 3.9, with NGX HFA2. Prior to this, we had 2 firewalls running VRRP, with subtely different rule bases. On the old rule bases, we had Site to Site and Remote Access VPN's working without any problems.

Since changing the configuration to have a CP Express Cluster, consisting of 2 gateways, we have been unable to establish any VPNs.

We have run vpn debug on and vpn debug ikeon, and collected traces. In addition, we have run debugs on a remote tunnel end point, and we have run local tcpdumps. All information suggests that we are sending out Phase 1 IKE packets, but do not respond to the replies. The replies are received, (shown by tcpdump) however they do not appear to be processed by VPN-1.

Looking through vpnd.elg, we see a constant message - fw_getfwifnum: no interface name. Does anyone know what this means? We have logical interfaces defined in IPSO - and logical interface names defined within Checkpoint Topology.

If anyone can provide any pointers to what fw_getfwifnum: no interface name means - and whether this could cause a VPNDaemon problem, I would love to hear.

Thanks in anticipation.

Rowland

https://www.nettitude.com

[jcamillo]

I also have the same issue - in my vpnd.elg log I am getting the same message: fw_getfwifnum: no interface name

So far I have a case open with Nokia support and they are working with Checkpoint.

Do you notice any Drops due to antispoofing in you tracker logs?

[JOBAR]

Did you allready try with a reboot of the firewall module ? I had the same problem after an upgrade, allways received the error : no interface name, and it seems to be resolved after an reboot.