The information you are about to copy is INTERNAL!
DO NOT share it with anyone outside Check Point.
|
Cannot simultaneously ping Virtual IP address of the cluster and IP addresses of physical interfaces on cluster members from a remote host
|
Technical Level
|
| Solution ID |
sk26874 |
| Technical Level |
|
| Product |
ClusterXL, Quantum Security Gateways, VSX, Cluster - 3rd party |
| Version |
All |
| Platform / Model |
All |
| Date Created |
30-Aug-2004
|
| Last Modified |
23-Sep-2021
|
Symptoms
- Unable to simultaneously ping the Cluster VIP address and physical IP address of a cluster member from a remote host.
- Unable to simultaneously ping multiple interfaces of the Security Gateway / cluster member.
- Kernel debug (
fw ctl debug -m fw + conn vm drop) shows:
;fwconn_set_link: failed to set the link (-3);
;fwconn_set_link: link collision ignored by SXL;
;fw_handle_first_packet: fwconn_init_links failed. Dropping packet;
;fw_log_drop: Packet proto=1 x.x.x.x:M -> x.x.x.x:N dropped by fw_handle_first_packet Reason: fwconn_init_links (INBOUND) failed
Cause
- When the Check Point Security Gateway / cluster member creates an ICMP connection in the Connections Table, a dummy port is allocated in order to make this connection unique (ICMP packets do not have real port numbers). The dummy port is calculated based on protocol-level session IDs.
Under certain conditions, the dummy port is calculated to be the same for multiple connections, which causes a conflict in the Connections Table that then causes the drop.
- In ClusterXL configured in High Availability New Mode / VRRP cluster, the ICMP Requests sent to the Cluster Virtual IP (VIP) address and to the IP address of the physical interface on the Active/Master member are processed by Active/Master member ("NAT-folded" from physical IP address of Active member). Because these two ICMP Requests have the same parameters, the Active/Master member cannot distinguish between them. As a result, the first of these two ICMP Requests is processed correctly, and the second of these two ICMP Requests is dropped.
Solution
|
Note: To view this solution you need to
Sign In
.
|
