Nortel Switched Firewall 2.3.3 User’s Guide and Command Reference
Redundant Firewalls
147
213455-L, October 2005
(addr1) on port 4. When link 2 fails, NSF#2 takes over all of NSF#1’s interfaces and sends out
GARP messages to remote caches. Now NSF# 2 is the active master on all interfaces and
handles all of NSF#1’s traffic. When the failure on link 2 is repaired, NSF#1 takes over its
interfaces and becomes the active master again for all its virtual routers.
Requirements
See
Requirements on page 127
.
Installing the redundant Switched Firewall
See
Installing the redundant Switched Firewall on page 128
.
Configuration check list
1.
The Check Point sync network should be in a separate interface. It can also be in the SSI
subnet.
2.
If the sync interface is not the SSI interface, then make sure
/cfg/net/if
<#>/vrrp/ip1
and
/cfg/net/if<#>/vrrp/ip2
settings for the sync interface is
0.0.0.0.
3.
VLAN is not supported on the sync interface.
4.
Make sure the routers are pointing to the
ip1
and
ip2
addresses in the
/cfg/net/if
<#>/vrrp
menu (200.1.1.100 or 100.1.1.100 in the sample configuration ) and not to
addr1
and
addr2
addresses in the
/cfg/net/if<#>
(200.1.1.100 or 100.1.1.100 in
the sample configuration )
menu.
5.
Don’t use the SSI MIP as the default gateway.
6.
Make sure you have unchecked ClusterXL under the Cluster general properties tab in
the Check Point SmartDashboard tool.
7.
Do not enable
Automatic proxy arp
configuration in the SmartDashboard global
properties tab. If you want to enable
proxy arp,
then enable Proxy ARP in the CLI
(
/cfg/net/adv/parp/ena y
) instead.
8.
If you have NATing enabled in any of the VRRP interface, make sure VRRP packets
(packets destined for 224.0.0.18) are not at all NATed. You can add this as the first
manual NATing rule.
